Previous version: MLA-C01. The current version is
MLA-C02.
Four control families for securing an ML workload
| Control family | Primary mechanism | What it protects against | Detective or preventive |
|---|
| Access control | IAM execution role + scoped policies, SageMaker Role Manager personas | Over-broad permissions, the wrong principal calling SageMaker AI | Preventive |
| Network isolation | VpcConfig (subnets + security groups), VPC interface/gateway endpoints (PrivateLink), EnableNetworkIsolation | Data exfiltration, internet exposure of training/inference | Preventive |
| Encryption | KMS VolumeKmsKeyId + OutputDataConfig KmsKeyId at rest, EnableInterContainerTrafficEncryption in transit | Unauthorized read of artifacts/data at rest or weights in transit | Preventive |
| Audit & data protection | CloudTrail, IAM Access Analyzer, Amazon Macie | Undetected access, external sharing, PII landing in datasets | Detective |
Decision tree
Cheat sheet Cheat sheet
- SageMaker AI acts through an execution role, not your user
- AmazonSageMakerFullAccess only covers SageMaker/aws-glue-named S3 buckets
- VpcConfig keeps traffic in your VPC but still allows egress
- EnableNetworkIsolation blocks all outbound calls from the container
- Network isolation and a VPC combine; SageMaker downloads data separately
- Chainer and RL managed containers cannot use network isolation
- AWS Marketplace algorithms require network isolation
- Reach AWS services privately with VPC endpoints and PrivateLink
- Encrypt the ML storage volume with VolumeKmsKeyId
- VolumeKmsKeyId is ignored on local NVMe instance storage
- Encrypt model artifacts with OutputDataConfig KmsKeyId
- Cross-account output requires a customer managed KMS key
- EnableInterContainerTrafficEncryption protects distributed-training traffic
- SageMaker Role Manager builds persona-based least-privilege roles
- IAM Access Analyzer generates a least-privilege policy from CloudTrail
- Access Analyzer flags resources shared with an external principal
- CloudTrail is the audit trail for SageMaker AI API calls
- Amazon Macie discovers PII in S3 before it reaches a training set
- Secure a CI/CD pipeline with a scoped role and secrets in Secrets Manager
- Map the security stem to one of four control families
- GuardDuty auto-analyzes CloudTrail to detect credential exfiltration in ML workloads
- CloudTrail Lake keeps events for years and lets you query them with SQL
- Route SageMaker Endpoint State Change events through EventBridge to automate response
- sourceIdentity attributes shared-role Studio actions to individual users in CloudTrail
- A private REST API plus an aws:SourceVpce resource policy blocks public access
- A Lambda authorizer validates third-party OAuth/JWT tokens and caches the decision