amazon-sagemaker-secure-mlops/cfn_templates/env-s3.yaml at master · My-Machine-Learning-Projects-CT/amazon-sagemaker-secure-mlops · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
# Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
# SPDX-License-Identifier: MIT-0

AWSTemplateFormatVersion: '2010-09-09'
Description: |
  Create Amazon S3 buckets for Data Science Environment

Outputs:
  DataBucketName:
    Description: Name of the Amazon S3 bucket for data
    Value: !Ref DataBucketName
    Export:
      Name: !Sub ${EnvName}-${EnvType}-data-bucket-name

  ModelBucketName:
    Description: Name of the Amazon S3 bucket for models
    Value: !Ref ModelBucketName
    Export:
      Name: !Sub ${EnvName}-${EnvType}-model-bucket-name

Parameters:
  EnvName:
    Type: String
    AllowedPattern: '[a-z0-9\-]*'
    Description: Please specify your data science environment name.  Used as a suffix for environment resource names.

  EnvType:
    Description: System Environment (e.g. dev, test, prod). Used as a suffix for environment resource names.
    Type: String
    Default: dev

  DataBucketName:
    Description: S3 bucket name to store data
    Type: String

  ModelBucketName:
    Description: S3 bucket name to store models
    Type: String

  VPCEndpointS3Id:
    Description: Id of the S3 VPC endpoint
    Type: String

  S3BucketKMSKeyId:
    Description: KMS Key Id for the data and model buckets
    Type: String

Resources:

  DataBucket:
    Type: AWS::S3::Bucket
    Properties:
      BucketName: !Ref DataBucketName
      AccessControl: Private
      PublicAccessBlockConfiguration:
        BlockPublicAcls: TRUE
        BlockPublicPolicy: TRUE
        IgnorePublicAcls: TRUE
        RestrictPublicBuckets: TRUE
      BucketEncryption:
        ServerSideEncryptionConfiguration:
          - ServerSideEncryptionByDefault:
              SSEAlgorithm: 'aws:kms'
              KMSMasterKeyID: !Ref S3BucketKMSKeyId
      Tags:
        - Key: EnvironmentName
          Value: !Ref EnvName
        - Key: EnvironmentType
          Value: !Ref EnvType

  ModelBucket:
    Type: AWS::S3::Bucket
    Properties:
      BucketName: !Ref ModelBucketName
      AccessControl: Private
      PublicAccessBlockConfiguration:
        BlockPublicAcls: TRUE
        BlockPublicPolicy: TRUE
        IgnorePublicAcls: TRUE
        RestrictPublicBuckets: TRUE
      BucketEncryption:
        ServerSideEncryptionConfiguration:
          - ServerSideEncryptionByDefault:
              SSEAlgorithm: 'aws:kms'
              KMSMasterKeyID: !Ref S3BucketKMSKeyId
      Tags:
        - Key: EnvironmentName
          Value: !Ref EnvName
        - Key: EnvironmentType
          Value: !Ref EnvType

  DataBucketPolicy:
    Type: 'AWS::S3::BucketPolicy'
    Properties:
      Bucket: !Ref DataBucket
      PolicyDocument:
        Statement:
          - Action:
              - 's3:GetObject'
              - 's3:PutObject'
              - 's3:ListBucket'
            Effect: Deny
            Resource:
              - !Sub "arn:aws:s3:::${DataBucket}/*"
              - !Sub "arn:aws:s3:::${DataBucket}"
            Principal: '*'
            Condition:
              StringNotEquals:
                'aws:sourceVpce': !Ref VPCEndpointS3Id #Allow access only via S3 VPC endpoint
                'aws:PrincipalTag/Principal':
                  #Exception for SageMaker pipeline execution role to read evaluation.json using JsonGet
                  - !Sub '${EnvName}-${EnvType}-sm-pipeline-role'
                  #Exception for Feature Store replication to S3 bucket - you might create a dedicated FeatureStore role
                  - !Sub '${EnvName}-${EnvType}-sm-execution-role'
              Bool:
                #Exception for - #### Check if this exception is needed ####
                'aws:ViaAWSService': 'false'

  ModelBucketPolicy:
    Type: 'AWS::S3::BucketPolicy'
    Properties:
      Bucket: !Ref ModelBucket
      PolicyDocument:
        Statement:
          - Sid: AllowCrossAccount
            Action:
              - 's3:GetObject'
              - 's3:ListBucket'
            Effect: Allow
            Principal:
              AWS:
                - !Ref AWS::AccountId
            Resource:
              - !Sub "arn:aws:s3:::${ModelBucket}/*"
              - !Sub "arn:aws:s3:::${ModelBucket}"
          - Sid: DenyNoVPC
            Action:
              - 's3:GetObject'
              - 's3:PutObject'
              - 's3:ListBucket'
              - 's3:GetBucketAcl'
              - 's3:GetObjectAcl'
              - 's3:PutBucketAcl'
              - 's3:PutObjectAcl'
            Effect: Deny
            Resource:
              - !Sub "arn:aws:s3:::${ModelBucket}/*"
              - !Sub "arn:aws:s3:::${ModelBucket}"
            Principal: '*'
            Condition:
              StringNotEquals:
                'aws:sourceVpce': !Ref VPCEndpointS3Id
                'aws:PrincipalTag/Principal': !Sub '${EnvName}-${EnvType}-sm-pipeline-role' #Exception for SageMaker pipeline execution role
              Bool:
                #Exception for SageMaker execution role (for RegisterModel step)
                'aws:ViaAWSService': 'false'