Translate

Thursday, November 12, 2020

AI Holistic Adoption for Manufacturing and Operations: Data  

By Dawn Fitzgerald, the AI Executive Leadership Insider  

Dawn Fitzgerald, VP of Engineering and Technical Operations, Homesite 

Part Three of Four Part Series: “AI Holistic Adoption for Manufacturing and Operations” is a four-part series which focuses on the executive leadership perspective including key execution topics required for the enterprise digital transformation journey and AI Holistic Adoption for manufacturing and operations organizations. Planned topics include: Value, Program, Data and Ethics. Here we address our third topic: Data.  

The Executive Leadership Perspective   

For the executive leader who is taking their enterprise on a journey of Digital Transformation and AI Holistic Adoption, we started this series with the foundation of Value and then moved to the framework of the Program. Although these are the fundamental building blocks required for success, the results of any enterprise’s analytics, do, in the end, rely on the Data.  

The executive leader has the responsibility to ensure that they and their team are dedicated to mastering data fluency and data excellence in the enterprise. The facets of Data Management are vast with the standard areas of focus including data discovery, collection, preparation, categorization and protection. Strategies for achieving maturity in these areas are well-established in most industries, and yet many industries still struggle. These standard areas of focus in Data Management are indeed necessary but are not sufficient for the needed AI Holistic Adoption.  

To incorporate AI Holistic Adoption, a value focus must be employed where we create Value Analytics (VAs) as output from our enterprise Analytics Program. To support this program, we must expand our enterprise Data Management definition to include a Data Optimality metric, a Data Evolution Roadmap and a Data Value Efficiency metric. 

The Data Optimality metric tells us how close the Value Analytics (VA) Baseline Dataset is to ‘optimal’. The Data Evolution Roadmap captures the milestones for the evolution of our Baseline Dataset for each Value Analytics release and the corresponding goals for harvesting data. The Data Value Efficiency metric simply measures how much value we achieve from harvested data. The combination of these is a powerful tool set for the executive leader to ensure the data provides the highest value to enterprise analytics at the lowest cost to the organization.  

The Data Optimality Metric Definition  

The Data Optimality metric tells us how close the Value Analytics (VA) Baseline Dataset is to the Data Scientist-defined ‘optimal’. The Baseline Dataset is a key component to any Value Analytic. The Baseline Dataset captures the data used for the VA as it relates to a specific development release. This link to a release is a critical distinction. By tying the Baseline Dataset to the VA design release, we recognize a snapshot of the training data associated with a specific release. We recognize that it may not be optimal so may change during the lifetime of the VA, and we plan for its change on a Data Evolution Roadmap.   

To achieve enterprise AI Holistic Adoption the executive leader must ensure the foundation of Value which anchors the effort. They must also incorporate the nature of a technical development effort. Specifically, they must account for the go-to-market demands that drive risk management decisions regarding minimal viable product (MVP) in Agile or SAFe (Scaled Agile Framework) methodologies. By the very nature of development, the MVP-driven organization will plan early deliverables with incremental improvements over time. This will apply to the Baseline Dataset as well and thus, the Data Optimality Metric is created. It is used for visibility of the state of our Baseline Dataset, used to communicate expectations of its impact on the VA and used to drive the evolution of the data.   

Data Optimality Metric Example  

To illustrate the power of the Data Optimality metric, consider the Data Scientist who has defined an equipment predictive maintenance algorithm and has a corresponding Baseline Dataset definition. They will have defined the optimal dataset that they want which includes the IoT measurements (for example: temp, pressure and vibration), the duration of time they would like the Data collected over (for example: 6 months), the population size (for example: data collected from 10 Data Centers covering four key climate zone geographies) and a guaranteed data quality level (for example less than 10% data gaps). Since there is a low probability of this optimal Baseline Dataset availability aligning with the market-driven release timeline demands, the Data Scientist may be forced to compromise their initial Baseline Dataset by taking fewer IoT parameters (for example: only temp and pressure but no vibration), having shorter collection duration (for example: 3 months vs 6), having a smaller population size (for example: only 3 Data Centers vs 10) or accepting a lower quality level guarantee. The Data Scientist may also create simulated data for some or all of the data gaps.   

The Data Scientist will then assign a Data Optimality metric to the current release Baseline Dataset (for example: current available data achieves 60% of the optimal dataset criteria). They will also state the lower Data Optimality metrics potential impact on the Value Analytic (for example: customers can expect only a 30-day prediction vs 90-day prediction pre-failure). 

The executive leader can then make a business decision to go forward with this Data Optimality metric or wait the extra time necessary to harvest improved data to achieve a higher Data Optimality metric and corresponding VA improvement. To conclude this scenario example, input from the marketing team may indicate that a Q2 release of the VA with the current Data Optimality metric is acceptable due to first mover advantage and significant value, compared to competitive offers, delivered to the customer.  

They may also specify that the higher Data Optimality metric must be achieved by Q4 in order to remain competitive. The Data Optimality metric enables defined incremental improvements to the Baseline Dataset over time which transcend to the ongoing VA improvement lifecycle. 

The visibility provided by the Data Optimality metric is especially valuable with leading edge Value Analytic capabilities where first mover advantage in the market can lead to a substantial market penetration foothold for the business. The metric drives cost saving by bringing the decision point of release impacting information down to the local business, where the knowledge of the business is the highest. This simultaneously gives visibility to future data management actions through the enterprise and should be captured in the Data Evolution Roadmap.  

The Data Evolution Roadmap  

Driven by Data Optimality metric inputs, the Data Evolution Roadmap captures the milestones for the evolution of our Baseline Dataset for each Value Analytics release and the corresponding goals for harvesting future required data. The Data Evolution Roadmap establishes an enterprise framework that provides visibility, alignment, clarity and flexibility for local business decisions. It also challenges the business to define the Data Optimality metric and track Baseline Dataset improvements.   

The power of the Data Evolution Roadmap enables the local businesses’ Agile development methodologies, gives cross-functional visibility of data management actions and delivers Data Management cost saving to the enterprise. Incremental improvements of the Data Optimality metric for a specific Value Analytic can be timed on the Data Evolution Roadmap based on demand. Early market traction data can be incorporated to update the business decision thus generating higher confidence in the data management expenditures and potential cost savings if deemed no longer necessary.  

To achieve AI Holistic Adoption, the Data Evolution Roadmap must align directly to the Value Analytics Roadmap. Data management tasks must align and be traceable through both roadmaps to a higher end value. Successful execution of this requires rapid, tightly coupled agile development teams that span the key enterprise stakeholders such as IoT development, Data management, Data Science, platform development and marketing/sales functions. This demand-pull approach to Data Management aligns well with Agile development practices and combats the seemingly overwhelming challenges of exponential data repository growth and corresponding data management costs.   

Data Repository Growth  

The growth of the data repository should parallel the growth and maturity of the Analytics Program to ensure data excellence and avoid dark data obsolescence. The cost of technical debt must be acknowledged and measured.  

Many companies make the mistake of a volume goal of collecting IoT data without a defined data evolution strategy aligned with the Analytics Program grounded in value. This leads to the data swamp, a stalling of the realization of Value from the AI solutions and an overall low Data Value Efficiency score as defined below.  

A tighter alignment of the Data Management tasks with the Value Analytics also provides opportunity for more value-based incremental improvements of the enterprises’ tagging strategy. Tagging data with both technical and business metadata is critical but seldom done correctly first pass and certainly not without a Value focus, which requires a cross-functional team of a data architect, data scientist, subject-matter expert and marketing that anchor the value. The mechanism to continuously improve your data tagging methodology must be close to the value goals of the Analytics Program.   

The Data Value Efficiency  

Once the Data Optimality metric and Data Evolution Roadmap are established, a Digital Value Efficiency (DVE) metric can be measured. The Data Value Efficiency (DVE), a measurement attached to data elements, is simply the measure of how much value we achieve from harvested data. The DVE tracks the use of the data by its inclusion in different VA Baseline Datasets over time.  

In most industries using AI, this metric would be considered very low. IDC research defines that currently, “80% of time is spent on data discovery, preparation, and protection, and only 20% of time is spent on actual analytics and getting to insight.” To achieve high DVE, a larger portion of our data harvested must translate into higher value actionable insights.  

Since the executive leader’s responsibility is to ensure that the organization is efficient with the data management, they must focus their organization on shifting the percentage of time invested from data discovery, collection and preparation to a higher amount of time used in training models and insight generation. The DVE metric gives visibility to progress toward this goal.  

The Data Evolution Roadmap pivots the enterprise focus from one of maximum data collection, and corresponding cost, to one of minimized data collection driven by the Value Analytics roadmap. Over time, this will improve the DVE metric and overall data excellence of the enterprise.  

Dawn Fitzgerald is VP of Engineering and Technical Operations at Homesite, an American Family Insurance company, where she is focused on Digital Transformation. Prior to this role, Dawn was a Digital Transformation & Analytics executive at Schneider Electric for 11 years. She is also currently the Chair of the Advisory Board for MIT’s Machine Intelligence for Manufacturing and Operations program. All opinions in this article are solely her own and are not reflective of any organization. 



from AI Trends https://ift.tt/38CCnZb
via A.I .Kung Fu

Epic's free game this week is a "bullet hell" action game with a lot of typing - CNET

The Textorcist: The Story of Ray Bibbia is the most unusual indie game you'll play all year.

from CNET News https://ift.tt/3ndmyfE
via A.I .Kung Fu

Marvel Cinematic Universe Phase 4: The full list of release dates - CNET

Here's where Black Widow, Spider-Man, Thor, Doctor Strange and the Disney Plus shows currently stand in the viewing calendar.

from CNET News https://ift.tt/2SB0q1C
via A.I .Kung Fu

32 best movies to watch on Netflix - CNET

Not sure what to watch tonight? Here are some of the best movies Netflix has to offer.

from CNET News https://ift.tt/3eTi6zP
via A.I .Kung Fu

17 best TV shows to stream on Amazon Prime Video - CNET

Looking for a great show to watch tonight? Let's round up Amazon's best gems.

from CNET News https://ift.tt/2K4rbKQ
via A.I .Kung Fu

Assassin's Creed Valhalla: The Nordic and English history you need to know - CNET

The more you know about the target, the sweeter the victory.

from CNET News https://ift.tt/35qpb7X
via A.I .Kung Fu

We'll spend nearly a decade of our lives staring at our phones, study says - CNET

That sure puts things into perspective.

from CNET News https://ift.tt/2UoUOZk
via A.I .Kung Fu

TikTok lives to see another day in US

US Commerce Department halts ban on Chinese owned company.

from BBC News - Technology https://ift.tt/3kp7qKw
via A.I .Kung Fu

Inside Parler, the Right's Favorite 'Free Speech' App

The top app on both Google and Apple's app stores this week promises conservatives a safe space—but gives priority treatment to its most high-profile users.

from Wired https://ift.tt/38J9sTD
via A.I .Kung Fu

Disney+ Passes 73 Million Subscribers as Streaming Takes Center Stage

The company has experienced deep losses in its theme park because of the pandemic, but investors don’t seem to care at the moment.

from NYT > Technology https://ift.tt/38EW1Ea
via A.I .Kung Fu

At all-hands, Zuckerberg said that Biden won the election, Bannon violated policies but not enough to shutter his account, Facebook isn't adverse to legislation (BuzzFeed News)

BuzzFeed News:
At all-hands, Zuckerberg said that Biden won the election, Bannon violated policies but not enough to shutter his account, Facebook isn't adverse to legislation  —  As false claims declaring that Joe Biden isn't the president-elect flourish on his platform, Facebook CEO Mark Zuckerberg told employees …



from Techmeme https://ift.tt/3kmFSVT
via A.I .Kung Fu

Wednesday, November 11, 2020

Honda is bringing Level 3 autonomy to production vehicles in Japan - Roadshow

The tech is called Traffic Jam Pilot and will debut in the Honda Legend sedan.

from CNET News https://ift.tt/3ngH13j
via A.I .Kung Fu

Xbox warns players not to blow vape smoke through their new Xbox Series X - CNET

"We can't believe we have to say this," Xbox tweeted.

from CNET News https://ift.tt/2IyDG0c
via A.I .Kung Fu

PS5: PlayStation's 'most extraordinary' pandemic launch

The boss of PlayStation speaks to Newsbeat about launching the PS5.

from BBC News - Technology https://ift.tt/36pBDEh
via A.I .Kung Fu

Best Black Friday 2020 laptop deals: Savings on HP, Lenovo, Surface and more - CNET

You don't need to wait until Black Friday to get a deal on a new laptop.

from CNET News https://ift.tt/3eP0YeB
via A.I .Kung Fu

More Rivian R1T and R1S details revealed, configurator goes live Nov. 16 - Roadshow

Rivian announced specifications for the Adventure and Explore packages.

from CNET News https://ift.tt/2GSSjLv
via A.I .Kung Fu

Xbox Game Pass: 16 awesome Xbox and PC games to play right now - CNET

If you're getting a new Xbox, you should also get Game Pass.

from CNET News https://ift.tt/3f2B4UV
via A.I .Kung Fu

YouTube experiencing video playback issues - CNET

The site is up, but videos aren't playing.

from CNET News https://ift.tt/2ItmfOK
via A.I .Kung Fu

YouTube is experiencing video playback issues worldwide, with YouTube TV and Google TV also affected; YouTube says it is working on a fix (Jay Peters/The Verge)

Jay Peters / The Verge:
YouTube is experiencing video playback issues worldwide, with YouTube TV and Google TV also affected; YouTube says it is working on a fix  —  It's not just you  —  YouTube seems to be having issues loading videos right now.  Several Verge staffers are having trouble watching videos …



from Techmeme https://ift.tt/36rCPqL
via A.I .Kung Fu

PS5 and Xbox Series X: Why you can avoid going next-gen until 2021 - CNET

Commentary: You don't need to drop hundreds of dollars on a shiny new console just yet.

from CNET News https://ift.tt/2UiGX6D
via A.I .Kung Fu

Electric next-gen Porsche Macan sneakily revealed in clay model form - Roadshow

Porsche released photos of a bunch of never-before-seen concept cars, and the new Macan EV is in the background of one of them.

from CNET News https://ift.tt/32D1Xtj
via A.I .Kung Fu

Black Friday Walmart deals available now: $379 HP laptop, $148 55-inch Roku smart TV and more - CNET

The next phase of the retailer's early sales is happening now.

from CNET News https://ift.tt/3lBj5aB
via A.I .Kung Fu

You'll spend 9 years of your life on your phone, study says - CNET

That sure puts things into perspective.

from CNET News https://ift.tt/3ngfK10
via A.I .Kung Fu

Microsoft: 'Please don't blow vape smoke into your Xbox Series X' - CNET

Videos circulated on Wednesday purporting to show the next-generation game console overheating and spewing smoke. It turns out people were just vaping into their Xbox.

from CNET News https://ift.tt/3eOXNDu
via A.I .Kung Fu

PS5: 8 things to do when you get your brand new PlayStation - CNET

The PS5 even has spoiler settings!

from CNET News https://ift.tt/35mtiSo
via A.I .Kung Fu

NASA gets go-ahead to bring Mars rocks back to Earth - CNET

An independent review has given NASA the green light to go get some chunks of the red planet through the Mars Sample Return campaign.

from CNET News https://ift.tt/3eQiTRU
via A.I .Kung Fu

You can buy a special Black Friday Nintendo Switch bundle on Nov. 22 - CNET

Here's where you can get a Switch right now -- spoiler, it's not many places -- and here are all the retailers selling the upcoming bundle.

from CNET News https://ift.tt/3pllaJS
via A.I .Kung Fu

Best PS4 gaming headset for 2020 - CNET

Looking for a new headset for your PlayStation 4? Here are our current top picks, from basic budget models that cost less than $50 to feature-packed high-end powerhouses.

from CNET News https://ift.tt/31llrCU
via A.I .Kung Fu

'Electronic skin' stretches, heals itself (and makes me dream of a cyborg future) - CNET

Can I get a full body suit of this stuff?

from CNET News https://ift.tt/38ye1Qv
via A.I .Kung Fu

Lucasfilm defends Baby Yoda's troubling meal in Mandalorian's latest episode - CNET

The scene on Disney Plus was "intentionally disturbing, for comedic effect," says a Lucasfilm executive.

from CNET News https://ift.tt/36pNgLn
via A.I .Kung Fu

The 17 best TV shows to stream on Amazon Prime Video - CNET

Searching for a great show to watch tonight? Let's round up Amazon's best gems.

from CNET News https://ift.tt/3kl9vXS
via A.I .Kung Fu

12 of the best TV shows to stream on Disney Plus - CNET

Searching for more great shows like The Mandalorian? Let's round up Disney's best gems.

from CNET News https://ift.tt/36vlrBp
via A.I .Kung Fu

From 2020's Singles' Day sale, which was extended to 12 days from 24 hours previously, Alibaba reported sales of $56.4B while JD.com reported sales of ~$30.1B (Arjun Kharpal/CNBC)

Arjun Kharpal / CNBC:
From 2020's Singles' Day sale, which was extended to 12 days from 24 hours previously, Alibaba reported sales of $56.4B while JD.com reported sales of ~$30.1B  —  - Alibaba set a new sales record for the annual Singles Day shopping event.  — Singles Day is typically a 24-hour shopping event …



from Techmeme https://ift.tt/38zPn1W
via A.I .Kung Fu

Google patches two Chrome zero-days that were exploited in the wild, after tips from anonymous sources; Google has patched five Chrome zero-days in three weeks (Catalin Cimpanu/ZDNet)

Catalin Cimpanu / ZDNet:
Google patches two Chrome zero-days that were exploited in the wild, after tips from anonymous sources; Google has patched five Chrome zero-days in three weeks  —  Google has now patched five Chrome zero-days in three weeks.  —  Google has released today Chrome version 86..4240.198 to patch …



from Techmeme https://ift.tt/2JUioLf
via A.I .Kung Fu

Tuesday, November 10, 2020

YouTube Premium members can get Stadia Premiere Edition for free - CNET

If you have a YouTube Premium account and sign up for Stadia, Google will gift you with Premiere Edition.

from CNET News https://ift.tt/2InyQmA
via A.I .Kung Fu

The best racing wheel and pedals for iRacing and your budget - Roadshow

Before you dive into the wild world of sim racing, you're going to need a wheel and pedals. Skip the cross-shopping and check out these favorites.

from CNET News https://ift.tt/3lmiHwh
via A.I .Kung Fu

Best DNA test for 2020: AncestryDNA vs. 23andMe and more - CNET

Looking for the best DNA test kit and the best testing services? Here are your top options.

from CNET News https://ift.tt/36qF0uu
via A.I .Kung Fu

The best detailing spray for cars in 2020 - Roadshow

Keep your car looking supreme in between a wash and wax with our top detailing spray products.

from CNET News https://ift.tt/3eL1SbQ
via A.I .Kung Fu

Uber, Lyft still sapped by COVID pandemic, plus 4 other takeaways this quarter - CNET

The latest earnings reports from both companies paint a complicated picture.

from CNET News https://ift.tt/2IsmsSy
via A.I .Kung Fu

Best place to buy tires online for 2020 - Roadshow

Buying tires can be a daunting and costly task. We've put together a list of the best places to buy tires online and what you should look for when shopping.

from CNET News https://ift.tt/38xzmcS
via A.I .Kung Fu

Best women's underwear for work outs in 2020 - CNET

Because you should be focused on your workout, not your undies.

from CNET News https://ift.tt/3kqmLuo
via A.I .Kung Fu

Remains of prehistoric flying reptile turn up among shark fossils - CNET

A British paleontologist discovers fragments of a mysterious new species of toothless pterosaur in a surprising place.

from CNET News https://ift.tt/3eKg1Gt
via A.I .Kung Fu

Analysis of Apple's A14 chip shows an increase in single-thread performance of nearly 3x in 5 years, suggesting M1 will be a formidable rival to x86 incumbents (Andrei Frumusanu/AnandTech)

Andrei Frumusanu / AnandTech:
Analysis of Apple's A14 chip shows an increase in single-thread performance of nearly 3x in 5 years, suggesting M1 will be a formidable rival to x86 incumbents  —  From Mobile to Mac: What to Expect?  —  To date, our performance comparisons for Apple's chipsets have always been in the context …



from Techmeme https://ift.tt/38w12Pl
via A.I .Kung Fu

Configuring Amazon SageMaker Studio for teams and groups with complete resource isolation

Amazon SageMaker is a fully managed service that provides every machine learning (ML) developer and data scientist with the ability to build, train, and deploy ML models quickly. Amazon SageMaker Studio is a web-based, integrated development environment (IDE) for ML that lets you build, train, debug, deploy, and monitor your ML models. Amazon SageMaker Studio provides all the tools you need to take your models from experimentation to production while boosting your productivity. You can write code, track experiments, visualize data, and perform debugging and monitoring within a single, integrated visual interface.

This post outlines how to configure access control for teams or groups within Amazon SageMaker Studio using attribute-based access control (ABAC). ABAC is a powerful approach that you can utilize to configure Studio so that different ML and data science teams have complete isolation of team resources.

We provide guidance on how to configure Amazon SageMaker Studio access for both AWS Identity and Access Management (IAM) and AWS Single Sign-On (AWS SSO) authentication methods. This post helps you set up IAM policies for users and roles using ABAC principals. To demonstrate the configuration, we set up two teams as shown in the following diagram and showcase two use cases:

  • Use case 1 – Only User A1 can access their studio environment; User A2 can’t access User A1’s environment, and vice versa
  • Use case 2 – Team B users cannot access artifacts (experiments, etc.) created by Team A members

You can configure policies according to your needs. You can even include a project tag in case you want to further restrict user access by projects within a team. The approach is very flexible and scalable.

Authentication

Amazon SageMaker Studio supports the following authentication methods for onboarding users. When setting up Studio, you can pick an authentication method that you use for all your users:

  • IAM – Includes the following:
    • IAM users – Users managed in IAM
    • AWS account federation – Users managed in an external identity provider (IdP)
  • AWS SSO – Users managed in an external IdP federated using AWS SSO

Data science user personas

The following table describes two different personas that interact with Amazon SageMaker Studio resources and the level of access they need to fulfill their duties. We use this table as a high-level requirement to model IAM roles and policies to establish desired controls based on resource ownership at the team and user level.

User Personas Permissions
Admin User

Create, modify, delete any IAM resource.

Create Amazon SageMaker Studio user profiles with a tag.

Sign in to the Amazon SageMaker console.

Read and describe Amazon SageMaker resources.

Data Scientists or Developers

Launch an Amazon SageMaker Studio IDE assigned to a specific IAM or AWS SSO user.

Create Amazon SageMaker resources with necessary tags. For this post, we use the team tag.

Update, delete, and run resources created with a specific tag.

Sign in to the Amazon SageMaker console if an IAM user.

Read and describe Amazon SageMaker resources.

Solution overview

We use the preceding requirements to model roles and permissions required to establish controls. The following flow diagram outlines the different configuration steps:

Applying your policy to the admin user

You should apply the following policy to the admin user who creates Studio user profiles. This policy requires the admin to include the studiouserid tag. You could use a different name for the tag if need be. The Studio console doesn’t allow you to add tags when creating user profiles, so we use the AWS Command Line Interface (AWS CLI).

For admin users managed in IAM, attach the following policy to the user. For admin users managed in an external IdP, add the following policy to the rule that the user assumes upon federation. The following policy enforces the studiouserid tag to be present when the sagemaker:CreateUserProfile action is invoked.

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "CreateSageMakerStudioUserProfilePolicy",
            "Effect": "Allow",
            "Action": "sagemaker:CreateUserProfile",
            "Resource": "*",
            "Condition": {
                "ForAnyValue:StringEquals": {
                    "aws:TagKeys": [
                        "studiouserid"
                    ]
                }
            }
        }
    ]
}

AWS SSO doesn’t require this policy; it performs the identity check.

Assigning the policy to Studio users

The following policy limits Studio access to the respective users by requiring the resource tag to match the user name for the sagemaker:CreatePresignedDomainUrl action. When a user tries to access the Amazon SageMaker Studio launch URL, this check is performed.

For IAM users, attach the following policy to the user. Use the user name for the studiouserid tag value.

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "AmazonSageMakerPresignedUrlPolicy",
            "Effect": "Allow",
            "Action": [
                "sagemaker:CreatePresignedDomainUrl"
            ],
            "Resource": "*",
            "Condition": {
                "StringEquals": {
                    "sagemaker:ResourceTag/studiouserid": "${aws:username}" 
                }
            }
        }
    ]
}

For AWS account federation, attach the following policy to role that the user assumes after federation:

{
   "Version": "2012-10-17",
   "Statement": [
       {
           "Sid": "AmazonSageMakerPresignedUrlPolicy",
           "Effect": "Allow",
           "Action": [
                "sagemaker:CreatePresignedDomainUrl"
           ],
           "Resource": "*",
           "Condition": {
                  "StringEquals": {
                      "sagemaker:ResourceTag/studiouserid": "${aws:PrincipalTag/studiouserid}"
                 }
            }
      }
  ]
}

Add the following statement to this policy in the Trust Relationship section. This statement defines the allowed transitive tag.

"Statement": [
     {
        --Existing statements
      },
      {
      "Sid": "IdentifyTransitiveTags",
      "Effect": "Allow",
      "Principal": {
        "Federated": "arn:aws:iam::<account id>:saml-provider/<identity provider>"
      },
      "Action": "sts:TagSession",
      "Condition": {
        "ForAllValues:StringEquals": {
          "sts:TransitiveTagKeys": [
            "studiouserid"
          ]
        }
      }
  ]

For users managed in AWS SSO, this policy is not required. AWS SSO performs the identity check.

Creating roles for the teams

To create roles for your teams, you must first create the policies. For simplicity, we use the same policies for both teams. In most cases, you just need one set of policies for all teams, but you have the flexibility to create different policies for different teams. In the second step, you create a role for each team, attach the policies, and tag the roles with appropriate team tags.

Creating the policies

Create the following policies. For this post, we split them into three policies for more readability, but you can create them according to your needs.

Policy 1: Amazon SageMaker read-only access

The following policy gives privileges to List and Describe Amazon SageMaker resources. You can customize this policy according to your needs.

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "AmazonSageMakerDescribeReadyOnlyPolicy",
            "Effect": "Allow",
            "Action": [
                "sagemaker:Describe*",
                "sagemaker:GetSearchSuggestions"
            ],
            "Resource": "*"
        },
        {
            "Sid": "AmazonSageMakerListOnlyPolicy",
            "Effect": "Allow",
            "Action": [
                "sagemaker:List*"
            ],
            "Resource": "*"
        },
        {
            "Sid": "AmazonSageMakerUIandMetricsOnlyPolicy",
            "Effect": "Allow",
            "Action": [
                "sagemaker:*App",
                "sagemaker:Search",
                "sagemaker:RenderUiTemplate",
                "sagemaker:BatchGetMetrics"
            ],
            "Resource": "*"
        },
        {
            "Sid": "AmazonSageMakerEC2ReadOnlyPolicy",
            "Effect": "Allow",
            "Action": [
                "ec2:DescribeDhcpOptions",
                "ec2:DescribeNetworkInterfaces",
                "ec2:DescribeRouteTables",
                "ec2:DescribeSecurityGroups",
                "ec2:DescribeSubnets",
                "ec2:DescribeVpcEndpoints",
                "ec2:DescribeVpcs"
            ],
            "Resource": "*"
        },
        {
            "Sid": "AmazonSageMakerIAMReadOnlyPolicy",
            "Effect": "Allow",
            "Action": [
                "iam:ListRoles"
            ],
            "Resource": "*"
        }
    ]
}

Policy 2: Amazon SageMaker access for supporting services

The following policy gives privileges to create, read, update, and delete access to Amazon Simple Storage Service (Amazon S3), Amazon Elastic Container Registry (Amazon ECR), and Amazon CloudWatch, and read access to AWS Key Management Service (AWS KMS). You can customize this policy according to your needs.

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "AmazonSageMakerCRUDAccessS3Policy",
            "Effect": "Allow",
            "Action": [
"s3:PutObject",
"s3:GetObject",
"s3:AbortMultipartUpload",
"s3:DeleteObject",
"s3:CreateBucket",
"s3:ListBucket",
"s3:PutBucketCORS",
"s3:ListAllMyBuckets",
"s3:GetBucketCORS",
                "s3:GetBucketLocation"         
              ],
            "Resource": "<S3 BucketName>"
        },
        {
            "Sid": "AmazonSageMakerReadOnlyAccessKMSPolicy",
            "Effect": "Allow",
            "Action": [
                "kms:DescribeKey",
                "kms:ListAliases"
            ],
            "Resource": "*"
        },
        {
            "Sid": "AmazonSageMakerCRUDAccessECRPolicy",
            "Effect": "Allow",
            "Action": [
"ecr:Set*",
"ecr:CompleteLayerUpload",
"ecr:Batch*",
"ecr:Upload*",
"ecr:InitiateLayerUpload",
"ecr:Put*",
"ecr:Describe*",
"ecr:CreateRepository",
"ecr:Get*",
                        "ecr:StartImageScan"
            ],
            "Resource": "*"
        },
        {
            "Sid": "AmazonSageMakerCRUDAccessCloudWatchPolicy",
            "Effect": "Allow",
            "Action": [
"cloudwatch:Put*",
"cloudwatch:Get*",
"cloudwatch:List*",
"cloudwatch:DescribeAlarms",
"logs:Put*",
"logs:Get*",
"logs:List*",
"logs:CreateLogGroup",
"logs:CreateLogStream",
"logs:ListLogDeliveries",
"logs:Describe*",
"logs:CreateLogDelivery",
"logs:PutResourcePolicy",
                        "logs:UpdateLogDelivery"
            ],
            "Resource": "*"
        }
    ]
} 

Policy 3: Amazon SageMaker Studio developer access

The following policy gives privileges to create, update, and delete Amazon SageMaker Studio resources.
It also enforces the team tag requirement during creation. In addition, it enforces start, stop, update, and delete actions on resources restricted only to the respective team members.

The team tag validation condition in the following code makes sure that the team tag value matches the principal’s team. Refer to the bolded code for specifcs.

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "AmazonSageMakerStudioCreateApp",
            "Effect": "Allow",
            "Action": [
                "sagemaker:CreateApp"
            ],
            "Resource": "*"
        },
        {
            "Sid": "AmazonSageMakerStudioIAMPassRole",
            "Effect": "Allow",
            "Action": [
                "iam:PassRole"
            ],
            "Resource": "*"
        },
        {
            "Sid": "AmazonSageMakerInvokeEndPointRole",
            "Effect": "Allow",
            "Action": [
                "sagemaker:InvokeEndpoint"
            ],
            "Resource": "*"
        },
        {
            "Sid": "AmazonSageMakerAddTags",
            "Effect": "Allow",
            "Action": [
                "sagemaker:AddTags"
            ],
            "Resource": "*"
        },
        {
            "Sid": "AmazonSageMakerCreate",
            "Effect": "Allow",
            "Action": [
                "sagemaker:Create*"
            ],
            "Resource": "*",
            "Condition": { "ForAnyValue:StringEquals": { "aws:TagKeys": [ "team" ] }, "StringEqualsIfExists": { "aws:RequestTag/team": "${aws:PrincipalTag/team}" } }
        },
        {
            "Sid": "AmazonSageMakerUpdateDeleteExecutePolicy",
            "Effect": "Allow",
            "Action": [
                "sagemaker:Delete*",
                "sagemaker:Stop*",
                "sagemaker:Update*",
                "sagemaker:Start*",
                "sagemaker:DisassociateTrialComponent",
                "sagemaker:AssociateTrialComponent",
                "sagemaker:BatchPutMetrics"
            ],
            "Resource": "*",
            "Condition": { "StringEquals": { "aws:PrincipalTag/team": "${sagemaker:ResourceTag/team}" } }
        }
    ]
}

Creating and configuring the roles

You can now create a role for each team with these policies. Tag the roles on the IAM console or with the CLI command. The steps are the same for all three authentication types. For example, tag the role for Team A with the tag key= team and value = “<Team Name>”.

Creating the Amazon SageMaker Studio user profile

In this step, we add the studiouserid tag when creating Studio user profiles. The steps are slightly different for each authentication type.

IAM users

For IAM users, you create Studio user profiles for each user by including the role that was created for the team the user belongs to. The following code is a sample CLI command. As of this writing, including a tag when creating a user profile is available only through AWS CLI.

aws sagemaker create-user-profile --domain-id <domain id> --user-profile-name <unique profile name> --tags Key=studiouserid,Value=<aws user name> --user-settings ExecutionRole=arn:aws:iam::<account id>:role/<Team Role Name>

AWS account federation

For AWS account federation, you create a user attribute (studiouserid) in an external IdP with a unique value for each user. The following code shows how to configure the attribute in Okta:

Example below shows how to add “studiouserid” attribute in OKTA. In OKTA’s SIGN ON METHODS screen, configure following SAML 2.0 attributes, as shown in the image below. 

Attribute 1:
Name: https://aws.amazon.com/SAML/Attributes/PrincipalTag:studiouserid 
Value: user.studiouserid

Attribute 2:
Name: https://aws.amazon.com/SAML/Attributes/TransitiveTagKeys
Value: {"studiouserid"}

The following screenshot shows the attributes on the Okta console.

Next, create the user profile using the following command. Use the user attribute value in the preceding step for the studiouserid tag value.

aws sagemaker create-user-profile --domain-id <domain id> --user-profile-name <unique profile name> --tags Key=studiouserid,Value=<user attribute value> --user-settings ExecutionRole=arn:aws:iam::<account id>:role/<Team Role Name>

AWS SSO

For instructions on assigning users in AWS SSO, see Onboarding Amazon SageMaker Studio with AWS SSO and Okta Universal Directory.

Update the Studio user profile to include the appropriate execution role that was created for the team that the user belongs to. See the following CLI command:

aws sagemaker update-user-profile --domain-id <domain id> --user-profile-name <user profile name> --user-settings ExecutionRole=arn:aws:iam::<account id>:role/<Team Role Name> --region us-west-2

Validating that only assigned Studio users can access their profiles

When a user tries to access a Studio profile that doesn’t have studiouserid tag value matching their user name, an AccessDeniedException error occurs. You can test this by copying the link for Launch Studio on the Amazon SageMaker console and accessing it when logged in as a different user. The following screenshot shows the error message.

Validating that only respective team members can access certain artifacts

In this step, we show how to configure Studio so that members of a given team can’t access artifacts that another team creates.

In our use case, a Team A user creates an experiment and tags that experiment with the team tag. This limits access to this experiment to Team A users only. See the following code:

import sys
!{sys.executable} -m pip install sagemaker
!{sys.executable} -m pip install sagemaker-experiments

import time
import sagemaker
from smexperiments.experiment import Experiment

demo_experiment = Experiment.create(experiment_name = "USERA1TEAMAEXPERIMENT1",
                                    description = "UserA1 experiment",
                                    tags = [{'Key': 'team', 'Value': 'TeamA'}])

If a user who is not in Team A tries to delete the experiment, Studio denies the delete action. See the following code:

#command run from TeamB User Studio Instance
import time
from smexperiments.experiment import Experiment
experiment_to_cleanup = Experiment.load(experiment_name="USERA1TEAMAEXPERIMENT1")
experiment_to_cleanup.delete()

[Client Error]
An error occurred (AccessDeniedException) when calling the DeleteExperiment operation: User: arn:aws:sts:: :<AWS Account ID>::assumed-role/ SageMakerStudioDeveloperTeamBRole/SageMaker is not authorized to perform: sagemaker:DeleteExperiment on resource: arn:aws:sagemaker:us-east-1:<AWS Account ID>:experiment/usera1teamaexperiment1

Conclusion

In this post, we demonstrated how to isolate Amazon SageMaker Studio access using the ABAC technique. We showcased two use cases: restricting access to a Studio profile to only the assigned user (using the studiouserid tag) and restricting access to Studio artifacts to team members only. We also showed how to limit access to experiments to only the members of the team using the team tag. You can further customize policies by applying more tags to create more complex hierarchical controls.

Try out this solution for isolating resources by teams or groups in Amazon SageMaker Studio. For more information about using ABAC as an authorization strategy, see What is ABAC for AWS?


About the Authors

Vikrant Kahlir is Senior Solutions Architect in the Solutions Architecture team. He works with AWS strategic customers product and engineering teams to help them with technology solutions using AWS services for Managed Databases, AI/ML, HPC, Autonomous Computing, and IoT.

 

 

 

Rakesh Ramadas is an ISV Solution Architect at Amazon Web Services. His focus areas include AI/ML and Big Data.

 

 

 

 

Rama Thamman is a Software Development Manager with the AI Platforms team, leading the ML Migrations team.



from AWS Machine Learning Blog https://ift.tt/38vljnT
via A.I .Kung Fu

Man born without a hand gets Metal Gear Solid 3D-printed bionic arm

Daniel Melville gets a Metal Gear Solid bionic arm.
Daniel Melville, who was born without a right hand, has a real bionic arm based on the Metal Gear Solid video game series.Read More

from VentureBeat https://ift.tt/36migvL
via A.I .Kung Fu

The best board games to give for 2020: Gloomhaven, Marvel United and more - CNET

The hottest thing in gaming right now is classic low-tech tabletop experiences. Here's our line-up of some of the best board games for this year.

from CNET News https://ift.tt/3piFQSE
via A.I .Kung Fu

Ex-Microsoft engineer gets 9-year prison sentence for fraud scheme - CNET

He'd racked up 18 federal felonies leading up to the sentencing.

from CNET News https://ift.tt/3nc9WWi
via A.I .Kung Fu

12 best TV shows to stream on Disney Plus - CNET

Looking for more great shows like The Mandalorian? Let's round up Disney's best gems.

from CNET News https://ift.tt/35iHpbt
via A.I .Kung Fu

Best holiday gifts under $100 for 2020 - CNET

Looking for an affordable gift this holiday buying season? Here's a great lineup of gift ideas to help stretch your Benjamin.

from CNET News https://ift.tt/3peranD
via A.I .Kung Fu

Configuring Amazon SageMaker Studio for teams and groups with complete resource isolation

Amazon SageMaker is a fully managed service that provides every machine learning (ML) developer and data scientist with the ability to build, train, and deploy ML models quickly. Amazon SageMaker Studio is a web-based, integrated development environment (IDE) for ML that lets you build, train, debug, deploy, and monitor your ML models. Amazon SageMaker Studio provides all the tools you need to take your models from experimentation to production while boosting your productivity. You can write code, track experiments, visualize data, and perform debugging and monitoring within a single, integrated visual interface.

This post outlines how to configure access control for teams or groups within Amazon SageMaker Studio using attribute-based access control (ABAC). ABAC is a powerful approach that you can utilize to configure Studio so that different ML and data science teams have complete isolation of team resources.

We provide guidance on how to configure Amazon SageMaker Studio access for both AWS Identity and Access Management (IAM) and AWS Single Sign-On (AWS SSO) authentication methods. This post helps you set up IAM policies for users and roles using ABAC principals. To demonstrate the configuration, we set up two teams as shown in the following diagram and showcase two use cases:

  • Use case 1 – Only User A1 can access their studio environment; User A2 can’t access User A1’s environment, and vice versa
  • Use case 2 – Team B users cannot access artifacts (experiments, etc.) created by Team A members

You can configure policies according to your needs. You can even include a project tag in case you want to further restrict user access by projects within a team. The approach is very flexible and scalable.

Authentication

Amazon SageMaker Studio supports the following authentication methods for onboarding users. When setting up Studio, you can pick an authentication method that you use for all your users:

  • IAM – Includes the following:
    • IAM users – Users managed in IAM
    • AWS account federation – Users managed in an external identity provider (IdP)
  • AWS SSO – Users managed in an external IdP federated using AWS SSO

Data science user personas

The following table describes two different personas that interact with Amazon SageMaker Studio resources and the level of access they need to fulfill their duties. We use this table as a high-level requirement to model IAM roles and policies to establish desired controls based on resource ownership at the team and user level.

User Personas Permissions
Admin User

Create, modify, delete any IAM resource.

Create Amazon SageMaker Studio user profiles with a tag.

Sign in to the Amazon SageMaker console.

Read and describe Amazon SageMaker resources.

Data Scientists or Developers

Launch an Amazon SageMaker Studio IDE assigned to a specific IAM or AWS SSO user.

Create Amazon SageMaker resources with necessary tags. For this post, we use the team tag.

Update, delete, and run resources created with a specific tag.

Sign in to the Amazon SageMaker console if an IAM user.

Read and describe Amazon SageMaker resources.

Solution overview

We use the preceding requirements to model roles and permissions required to establish controls. The following flow diagram outlines the different configuration steps:

Applying your policy to the admin user

You should apply the following policy to the admin user who creates Studio user profiles. This policy requires the admin to include the studiouserid tag. You could use a different name for the tag if need be. The Studio console doesn’t allow you to add tags when creating user profiles, so we use the AWS Command Line Interface (AWS CLI).

For admin users managed in IAM, attach the following policy to the user. For admin users managed in an external IdP, add the following policy to the rule that the user assumes upon federation. The following policy enforces the studiouserid tag to be present when the sagemaker:CreateUserProfile action is invoked.

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "CreateSageMakerStudioUserProfilePolicy",
            "Effect": "Allow",
            "Action": "sagemaker:CreateUserProfile",
            "Resource": "*",
            "Condition": {
                "ForAnyValue:StringEquals": {
                    "aws:TagKeys": [
                        "studiouserid"
                    ]
                }
            }
        }
    ]
}

AWS SSO doesn’t require this policy; it performs the identity check.

Assigning the policy to Studio users

The following policy limits Studio access to the respective users by requiring the resource tag to match the user name for the sagemaker:CreatePresignedDomainUrl action. When a user tries to access the Amazon SageMaker Studio launch URL, this check is performed.

For IAM users, attach the following policy to the user. Use the user name for the studiouserid tag value.

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "AmazonSageMakerPresignedUrlPolicy",
            "Effect": "Allow",
            "Action": [
                "sagemaker:CreatePresignedDomainUrl"
            ],
            "Resource": "*",
            "Condition": {
                "StringEquals": {
                    "sagemaker:ResourceTag/studiouserid": "${aws:username}" 
                }
            }
        }
    ]
}

For AWS account federation, attach the following policy to role that the user assumes after federation:

{
   "Version": "2012-10-17",
   "Statement": [
       {
           "Sid": "AmazonSageMakerPresignedUrlPolicy",
           "Effect": "Allow",
           "Action": [
                "sagemaker:CreatePresignedDomainUrl"
           ],
           "Resource": "*",
           "Condition": {
                  "StringEquals": {
                      "sagemaker:ResourceTag/studiouserid": "${aws:PrincipalTag/studiouserid}"
                 }
            }
      }
  ]
}

Add the following statement to this policy in the Trust Relationship section. This statement defines the allowed transitive tag.

"Statement": [
     {
        --Existing statements
      },
      {
      "Sid": "IdentifyTransitiveTags",
      "Effect": "Allow",
      "Principal": {
        "Federated": "arn:aws:iam::<account id>:saml-provider/<identity provider>"
      },
      "Action": "sts:TagSession",
      "Condition": {
        "ForAllValues:StringEquals": {
          "sts:TransitiveTagKeys": [
            "studiouserid"
          ]
        }
      }
  ]

For users managed in AWS SSO, this policy is not required. AWS SSO performs the identity check.

Creating roles for the teams

To create roles for your teams, you must first create the policies. For simplicity, we use the same policies for both teams. In most cases, you just need one set of policies for all teams, but you have the flexibility to create different policies for different teams. In the second step, you create a role for each team, attach the policies, and tag the roles with appropriate team tags.

Creating the policies

Create the following policies. For this post, we split them into three policies for more readability, but you can create them according to your needs.

Policy 1: Amazon SageMaker read-only access

The following policy gives privileges to List and Describe Amazon SageMaker resources. You can customize this policy according to your needs.

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "AmazonSageMakerDescribeReadyOnlyPolicy",
            "Effect": "Allow",
            "Action": [
                "sagemaker:Describe*",
                "sagemaker:GetSearchSuggestions"
            ],
            "Resource": "*"
        },
        {
            "Sid": "AmazonSageMakerListOnlyPolicy",
            "Effect": "Allow",
            "Action": [
                "sagemaker:List*"
            ],
            "Resource": "*"
        },
        {
            "Sid": "AmazonSageMakerUIandMetricsOnlyPolicy",
            "Effect": "Allow",
            "Action": [
                "sagemaker:*App",
                "sagemaker:Search",
                "sagemaker:RenderUiTemplate",
                "sagemaker:BatchGetMetrics"
            ],
            "Resource": "*"
        },
        {
            "Sid": "AmazonSageMakerEC2ReadOnlyPolicy",
            "Effect": "Allow",
            "Action": [
                "ec2:DescribeDhcpOptions",
                "ec2:DescribeNetworkInterfaces",
                "ec2:DescribeRouteTables",
                "ec2:DescribeSecurityGroups",
                "ec2:DescribeSubnets",
                "ec2:DescribeVpcEndpoints",
                "ec2:DescribeVpcs"
            ],
            "Resource": "*"
        },
        {
            "Sid": "AmazonSageMakerIAMReadOnlyPolicy",
            "Effect": "Allow",
            "Action": [
                "iam:ListRoles"
            ],
            "Resource": "*"
        }
    ]
}

Policy 2: Amazon SageMaker access for supporting services

The following policy gives privileges to create, read, update, and delete access to Amazon Simple Storage Service (Amazon S3), Amazon Elastic Container Registry (Amazon ECR), and Amazon CloudWatch, and read access to AWS Key Management Service (AWS KMS). You can customize this policy according to your needs.

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "AmazonSageMakerCRUDAccessS3Policy",
            "Effect": "Allow",
            "Action": [
"s3:PutObject",
"s3:GetObject",
"s3:AbortMultipartUpload",
"s3:DeleteObject",
"s3:CreateBucket",
"s3:ListBucket",
"s3:PutBucketCORS",
"s3:ListAllMyBuckets",
"s3:GetBucketCORS",
                "s3:GetBucketLocation"         
              ],
            "Resource": "<S3 BucketName>"
        },
        {
            "Sid": "AmazonSageMakerReadOnlyAccessKMSPolicy",
            "Effect": "Allow",
            "Action": [
                "kms:DescribeKey",
                "kms:ListAliases"
            ],
            "Resource": "*"
        },
        {
            "Sid": "AmazonSageMakerCRUDAccessECRPolicy",
            "Effect": "Allow",
            "Action": [
"ecr:Set*",
"ecr:CompleteLayerUpload",
"ecr:Batch*",
"ecr:Upload*",
"ecr:InitiateLayerUpload",
"ecr:Put*",
"ecr:Describe*",
"ecr:CreateRepository",
"ecr:Get*",
                        "ecr:StartImageScan"
            ],
            "Resource": "*"
        },
        {
            "Sid": "AmazonSageMakerCRUDAccessCloudWatchPolicy",
            "Effect": "Allow",
            "Action": [
"cloudwatch:Put*",
"cloudwatch:Get*",
"cloudwatch:List*",
"cloudwatch:DescribeAlarms",
"logs:Put*",
"logs:Get*",
"logs:List*",
"logs:CreateLogGroup",
"logs:CreateLogStream",
"logs:ListLogDeliveries",
"logs:Describe*",
"logs:CreateLogDelivery",
"logs:PutResourcePolicy",
                        "logs:UpdateLogDelivery"
            ],
            "Resource": "*"
        }
    ]
} 

Policy 3: Amazon SageMaker Studio developer access

The following policy gives privileges to create, update, and delete Amazon SageMaker Studio resources.
It also enforces the team tag requirement during creation. In addition, it enforces start, stop, update, and delete actions on resources restricted only to the respective team members.

The team tag validation condition in the following code makes sure that the team tag value matches the principal’s team. Refer to the bolded code for specifcs.

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "AmazonSageMakerStudioCreateApp",
            "Effect": "Allow",
            "Action": [
                "sagemaker:CreateApp"
            ],
            "Resource": "*"
        },
        {
            "Sid": "AmazonSageMakerStudioIAMPassRole",
            "Effect": "Allow",
            "Action": [
                "iam:PassRole"
            ],
            "Resource": "*"
        },
        {
            "Sid": "AmazonSageMakerInvokeEndPointRole",
            "Effect": "Allow",
            "Action": [
                "sagemaker:InvokeEndpoint"
            ],
            "Resource": "*"
        },
        {
            "Sid": "AmazonSageMakerAddTags",
            "Effect": "Allow",
            "Action": [
                "sagemaker:AddTags"
            ],
            "Resource": "*"
        },
        {
            "Sid": "AmazonSageMakerCreate",
            "Effect": "Allow",
            "Action": [
                "sagemaker:Create*"
            ],
            "Resource": "*",
            "Condition": { "ForAnyValue:StringEquals": { "aws:TagKeys": [ "team" ] }, "StringEqualsIfExists": { "aws:RequestTag/team": "${aws:PrincipalTag/team}" } }
        },
        {
            "Sid": "AmazonSageMakerUpdateDeleteExecutePolicy",
            "Effect": "Allow",
            "Action": [
                "sagemaker:Delete*",
                "sagemaker:Stop*",
                "sagemaker:Update*",
                "sagemaker:Start*",
                "sagemaker:DisassociateTrialComponent",
                "sagemaker:AssociateTrialComponent",
                "sagemaker:BatchPutMetrics"
            ],
            "Resource": "*",
            "Condition": { "StringEquals": { "aws:PrincipalTag/team": "${sagemaker:ResourceTag/team}" } }
        }
    ]
}

Creating and configuring the roles

You can now create a role for each team with these policies. Tag the roles on the IAM console or with the CLI command. The steps are the same for all three authentication types. For example, tag the role for Team A with the tag key= team and value = “<Team Name>”.

Creating the Amazon SageMaker Studio user profile

In this step, we add the studiouserid tag when creating Studio user profiles. The steps are slightly different for each authentication type.

IAM users

For IAM users, you create Studio user profiles for each user by including the role that was created for the team the user belongs to. The following code is a sample CLI command. As of this writing, including a tag when creating a user profile is available only through AWS CLI.

aws sagemaker create-user-profile --domain-id <domain id> --user-profile-name <unique profile name> --tags Key=studiouserid,Value=<aws user name> --user-settings ExecutionRole=arn:aws:iam::<account id>:role/<Team Role Name>

AWS account federation

For AWS account federation, you create a user attribute (studiouserid) in an external IdP with a unique value for each user. The following code shows how to configure the attribute in Okta:

Example below shows how to add “studiouserid” attribute in OKTA. In OKTA’s SIGN ON METHODS screen, configure following SAML 2.0 attributes, as shown in the image below. 

Attribute 1:
Name: https://aws.amazon.com/SAML/Attributes/PrincipalTag:studiouserid 
Value: user.studiouserid

Attribute 2:
Name: https://aws.amazon.com/SAML/Attributes/TransitiveTagKeys
Value: {"studiouserid"}

The following screenshot shows the attributes on the Okta console.

Next, create the user profile using the following command. Use the user attribute value in the preceding step for the studiouserid tag value.

aws sagemaker create-user-profile --domain-id <domain id> --user-profile-name <unique profile name> --tags Key=studiouserid,Value=<user attribute value> --user-settings ExecutionRole=arn:aws:iam::<account id>:role/<Team Role Name>

AWS SSO

For instructions on assigning users in AWS SSO, see Onboarding Amazon SageMaker Studio with AWS SSO and Okta Universal Directory.

Update the Studio user profile to include the appropriate execution role that was created for the team that the user belongs to. See the following CLI command:

aws sagemaker update-user-profile --domain-id <domain id> --user-profile-name <user profile name> --user-settings ExecutionRole=arn:aws:iam::<account id>:role/<Team Role Name> --region us-west-2

Validating that only assigned Studio users can access their profiles

When a user tries to access a Studio profile that doesn’t have studiouserid tag value matching their user name, an AccessDeniedException error occurs. You can test this by copying the link for Launch Studio on the Amazon SageMaker console and accessing it when logged in as a different user. The following screenshot shows the error message.

Validating that only respective team members can access certain artifacts

In this step, we show how to configure Studio so that members of a given team can’t access artifacts that another team creates.

In our use case, a Team A user creates an experiment and tags that experiment with the team tag. This limits access to this experiment to Team A users only. See the following code:

import sys
!{sys.executable} -m pip install sagemaker
!{sys.executable} -m pip install sagemaker-experiments

import time
import sagemaker
from smexperiments.experiment import Experiment

demo_experiment = Experiment.create(experiment_name = "USERA1TEAMAEXPERIMENT1",
                                    description = "UserA1 experiment",
                                    tags = [{'Key': 'team', 'Value': 'TeamA'}])

If a user who is not in Team A tries to delete the experiment, Studio denies the delete action. See the following code:

#command run from TeamB User Studio Instance
import time
from smexperiments.experiment import Experiment
experiment_to_cleanup = Experiment.load(experiment_name="USERA1TEAMAEXPERIMENT1")
experiment_to_cleanup.delete()

[Client Error]
An error occurred (AccessDeniedException) when calling the DeleteExperiment operation: User: arn:aws:sts:: :<AWS Account ID>::assumed-role/ SageMakerStudioDeveloperTeamBRole/SageMaker is not authorized to perform: sagemaker:DeleteExperiment on resource: arn:aws:sagemaker:us-east-1:<AWS Account ID>:experiment/usera1teamaexperiment1

Conclusion

In this post, we demonstrated how to isolate Amazon SageMaker Studio access using the ABAC technique. We showcased two use cases: restricting access to a Studio profile to only the assigned user (using the studiouserid tag) and restricting access to Studio artifacts to team members only. We also showed how to limit access to experiments to only the members of the team using the team tag. You can further customize policies by applying more tags to create more complex hierarchical controls.

Try out this solution for isolating resources by teams or groups in Amazon SageMaker Studio. For more information about using ABAC as an authorization strategy, see What is ABAC for AWS?


About the Authors

Vikrant Kahlir is Senior Solutions Architect in the Solutions Architecture team. He works with AWS strategic customers product and engineering teams to help them with technology solutions using AWS services for Managed Databases, AI/ML, HPC, Autonomous Computing, and IoT.

 

 

 

Rakesh Ramadas is an ISV Solution Architect at Amazon Web Services. His focus areas include AI/ML and Big Data.

 

 

 

 

Rama Thamman is a Software Development Manager with the AI Platforms team, leading the ML Migrations team.



from AWS Machine Learning Blog https://ift.tt/38vljnT
via A.I .Kung Fu

With Its Own Chips, Apple Aims to Define the Future of PCs

Intel processors are on their way out, replaced by home-grown designs, which will give the Mac maker more control of its destiny.

from Wired https://ift.tt/3eOmobS
via A.I .Kung Fu

Online mortgage lender Better.com has raised ~$200M Series D led by L Catterton according to an internal memo; sources say the round values the company at $4B (Bloomberg)

Bloomberg:
Online mortgage lender Better.com has raised ~$200M Series D led by L Catterton according to an internal memo; sources say the round values the company at $4B  —  Online mortgage lender Better.com has closed a new funding round led by private equity firm L Catterton, according to an internal memo reviewed by Bloomberg News.



from Techmeme https://ift.tt/3eKpzRP
via A.I .Kung Fu

Strategy Analytics: in Q3, Samsung sold more smartphones in the US than Apple for the first time in three years; Samsung had 33.7% marketshare, Apple had 30.2% (Yonhap News Agency)

Yonhap News Agency:
Strategy Analytics: in Q3, Samsung sold more smartphones in the US than Apple for the first time in three years; Samsung had 33.7% marketshare, Apple had 30.2%  —  Samsung Electronics Co. sold the largest number of smartphones in the United States in the third quarter of the year …



from Techmeme https://ift.tt/2InrzTO
via A.I .Kung Fu

Two US House representatives who oversee the FCC ask Ajit Pai to abandon "controversial items under consideration", likely referencing changes to Section 230 (Devin Coldewey/TechCrunch)

Devin Coldewey / TechCrunch:
Two US House representatives who oversee the FCC ask Ajit Pai to abandon “controversial items under consideration”, likely referencing changes to Section 230  —  Two U.S. Representatives who oversee the FCC have asked the agency to respect the results of the election by abandoning any …



from Techmeme https://ift.tt/38xxfps
via A.I .Kung Fu

Facebook says political content makes up about 6% of what is seen on its platform and says CrowdTangle measures engagement but doesn't predict reach (Sara Fischer/Axios)

Sara Fischer / Axios:
Facebook says political content makes up about 6% of what is seen on its platform and says CrowdTangle measures engagement but doesn't predict reach  —  Facebook Tuesday said that political content makes up only about 6% of what users actually see on its platform.



from Techmeme https://ift.tt/38wzOYA
via A.I .Kung Fu

Patreon partners with Acast, which will host creators' podcasts to simplify distribution of subscriber-only episodes and give them access to Acast analytics (Ashley Carman/The Verge)

Ashley Carman / The Verge:
Patreon partners with Acast, which will host creators' podcasts to simplify distribution of subscriber-only episodes and give them access to Acast analytics  —  Private RSS feeds are streamlined  —  Patreon's newest partnership might entice more podcasters to join its platform.



from Techmeme https://ift.tt/3lifwWA
via A.I .Kung Fu

Monday, November 9, 2020

2021 Land Rover Discovery update focuses on the tech - Roadshow

With a new infotainment system and more ways to connect, the Discovery is smarter -- and a little easier on the eyes, too.

from CNET News https://ift.tt/3eKu8v7
via A.I .Kung Fu

Apple's new Macs could change computers as we know them - CNET

As the insides of computers become more like iPhones, we can expect better battery life, thinner designs and even, maybe, a lower price tag.

from CNET News https://ift.tt/2GJvZnu
via A.I .Kung Fu

Alex Trebek's last Jeopardy episode will air on Christmas day - CNET

Legendary game-show host worked up until Oct. 29.

from CNET News https://ift.tt/3eKjeFV
via A.I .Kung Fu

NASA chief Jim Bridenstine will reportedly step down under Biden administration - CNET

The former Republican congressman reportedly thinks NASA should have a new chief.

from CNET News https://ift.tt/38mNqFY
via A.I .Kung Fu

PS5 launch games: Every PlayStation 5 title you can buy on Thursday - CNET

The PS5 has more than Miles Morales.

from CNET News https://ift.tt/3n0MICm
via A.I .Kung Fu

Get 6 months of Netflix bundled with Chromecast with Google TV streamer for $90 - CNET

The Google Store deal saves you $44, which is like getting the new Chromecast for $6.

from CNET News https://ift.tt/3l7m4XZ
via A.I .Kung Fu

17 of the best TV shows to watch on Amazon Prime Video - CNET

Looking for a great show to watch tonight? Let's round up Amazon's best gems.

from CNET News https://ift.tt/35gHJrg
via A.I .Kung Fu

The PS5's original design was even bigger than the one we got - CNET

How?

from CNET News https://ift.tt/2GIqFRg
via A.I .Kung Fu

Election 2020: Facebook, Twitter and YouTube wrestle with misinformation - CNET

The social media sites have their hands full.

from CNET News https://ift.tt/2I9z9Sf
via A.I .Kung Fu

Netflix is testing a regular, old-fashioned TV channel - CNET

But it would still be for subscribers only.

from CNET News https://ift.tt/35chjGS
via A.I .Kung Fu

Detectives and noxious locks take on bike thieves

The cycling industry is coming up with innovative ways to deter a wave of bike crime.

from BBC News - Technology https://ift.tt/38zEw7U
via A.I .Kung Fu

No, Software Glitches Are Not Affecting Vote Counts

Some Republicans have blamed software glitches for vote-count issues in Michigan and Georgia. The Michigan cases were caused by human error and soon fixed, while Georgia software issues didn’t affect tallies.

from NYT > Technology https://ift.tt/3ljI81x
via A.I .Kung Fu

Facebook Removes Pages Linked to Bannon for Pushing Misinformation

The pages, associated with the Stop the Steal hashtag, had about 2.5 million followers.

from NYT > Technology https://ift.tt/3pgzy5W
via A.I .Kung Fu

What to expect from Apple's "One More Thing" event: first Apple Silicon powered Macs, a macOS Big Sur release date, and potentially AirTags, over-ear headphones (Jay Peters/The Verge)

Jay Peters / The Verge:
What to expect from Apple's “One More Thing” event: first Apple Silicon powered Macs, a macOS Big Sur release date, and potentially AirTags, over-ear headphones  —  It seems likely Apple will reveal the first computers powered by its custom silicon



from Techmeme https://ift.tt/2U9YJsT
via A.I .Kung Fu

EU tightens rules on surveillance tech, forcing companies selling spyware, facial recognition, and tech with military uses to get a license, be more transparent (Patrick Howell O'Neill/MIT Technology ...)

Patrick Howell O'Neill / MIT Technology Review:
EU tightens rules on surveillance tech, forcing companies selling spyware, facial recognition, and tech with military uses to get a license, be more transparent  —  The goal is to make sales of technologies like spyware and facial recognition more transparent in Europe first, and then worldwide.



from Techmeme https://ift.tt/3pdYfjC
via A.I .Kung Fu

Enthusiast Gaming will be the first game media and influencer company on Nasdaq

Luminosity Gaming owns the Overwatch League team Vancouver Titans.
Enthusiast Gaming, an esports and gaming media firm, announced that it will become a publicly traded company on the Nasdaq stock market.Read More

from VentureBeat https://ift.tt/32pit03
via A.I .Kung Fu

You can stop panicking about the PlayStation 5 and Xbox Series X

This is a real picture of the PlayStation 5.
The PlayStation 5 and Xbox Series X are almost here, so it's time to stop worrying so much about every tiny detail.Read More

from VentureBeat https://ift.tt/36jim7s
via A.I .Kung Fu