Amazon SageMaker Service Update: This release adds support for launching Amazon SageMaker Studio in your VPC. Use AppNetworkAccessType in CreateDomain API to disable access to public internet and restrict the network traffic to VPC.

AWS · AWS · commit 631dd9a71f64 · 2020-10-05T18:04:06.000Z
diff --git a/.changes/next-release/feature-AmazonSageMakerService-b2f45f4.json b/.changes/next-release/feature-AmazonSageMakerService-b2f45f4.json
@@ -0,0 +1,5 @@
+{
+    "type": "feature",
+    "category": "Amazon SageMaker Service",
+    "description": "This release adds support for launching Amazon SageMaker Studio in your VPC. Use AppNetworkAccessType in CreateDomain API to disable access to public internet and restrict the network traffic to VPC."
+}
diff --git a/services/sagemaker/src/main/resources/codegen-resources/service-2.json b/services/sagemaker/src/main/resources/codegen-resources/service-2.json
@@ -112,7 +112,7 @@
         {"shape":"ResourceLimitExceeded"},
         {"shape":"ResourceInUse"}
       ],
-      "documentation":"<p>Creates a <code>Domain</code> used by SageMaker Studio. A domain consists of an associated directory, a list of authorized users, and a variety of security, application, policy, and Amazon Virtual Private Cloud (VPC) configurations. An AWS account is limited to one domain per region. Users within a domain can share notebook files and other artifacts with each other.</p> <p>When a domain is created, an Amazon Elastic File System (EFS) volume is also created for use by all of the users within the domain. Each user receives a private home directory within the EFS for notebooks, Git repositories, and data files.</p> <p>All traffic between the domain and the EFS volume is communicated through the specified subnet IDs. All other traffic goes over the Internet through an Amazon SageMaker system VPC. The EFS traffic uses the NFS/TCP protocol over port 2049.</p> <important> <p>NFS traffic over TCP on port 2049 needs to be allowed in both inbound and outbound rules in order to launch a SageMaker Studio app successfully.</p> </important>"
+      "documentation":"<p>Creates a <code>Domain</code> used by Amazon SageMaker Studio. A domain consists of an associated Amazon Elastic File System (EFS) volume, a list of authorized users, and a variety of security, application, policy, and Amazon Virtual Private Cloud (VPC) configurations. An AWS account is limited to one domain per region. Users within a domain can share notebook files and other artifacts with each other.</p> <p>When a domain is created, an EFS volume is created for use by all of the users within the domain. Each user receives a private home directory within the EFS volume for notebooks, Git repositories, and data files.</p> <p> <b>VPC configuration</b> </p> <p>All SageMaker Studio traffic between the domain and the EFS volume is through the specified VPC and subnets. For other Studio traffic, you specify the <code>AppNetworkAccessType</code> parameter. <code>AppNetworkAccessType</code> corresponds to the VPC mode that's chosen when you onboard to Studio. The following options are available:</p> <ul> <li> <p> <code>PublicInternetOnly</code> - Non-EFS traffic goes through a VPC managed by Amazon SageMaker, which allows internet access. This is the default value.</p> </li> <li> <p> <code>VpcOnly</code> - All Studio traffic is through the specified VPC and subnets. Internet access is disabled by default. To allow internet access, you must specify a NAT gateway.</p> <p>When internet access is disabled, you won't be able to train or host models unless your VPC has an interface endpoint (PrivateLink) or a NAT gateway and your security groups allow outbound connections.</p> </li> </ul> <p> <b> <code>VpcOnly</code> mode</b> </p> <p>When you specify <code>VpcOnly</code>, you must specify the following:</p> <ul> <li> <p>Security group inbound and outbound rules to allow NFS traffic over TCP on port 2049 between the domain and the EFS volume</p> </li> <li> <p>Security group inbound and outbound rules to allow traffic between the JupyterServer app and the KernelGateway apps</p> </li> <li> <p>Interface endpoints to access the SageMaker API and SageMaker runtime</p> </li> </ul> <p>For more information, see:</p> <ul> <li> <p> <a href=\"https://docs.aws.amazon.com/vpc/latest/userguide/VPC_SecurityGroups.html\">Security groups for your VPC</a> </p> </li> <li> <p> <a href=\"https://docs.aws.amazon.com/vpc/latest/userguide/VPC_Scenario2.html\">VPC with public and private subnets (NAT)</a> </p> </li> <li> <p> <a href=\"https://docs.aws.amazon.com/sagemaker/latest/dg/interface-vpc-endpoint.html\">Connect to SageMaker through a VPC interface endpoint</a> </p> </li> </ul>"
     },
     "CreateEndpoint":{
       "name":"CreateEndpoint",
@@ -283,7 +283,7 @@
       "errors":[
         {"shape":"ResourceNotFound"}
       ],
-      "documentation":"<p>Creates a URL for a specified UserProfile in a Domain. When accessed in a web browser, the user will be automatically signed in to Amazon SageMaker Studio, and granted access to all of the Apps and files associated with the Domain's Amazon Elastic File System (EFS) volume. This operation can only be called when the authentication mode equals IAM. </p>"
+      "documentation":"<p>Creates a URL for a specified UserProfile in a Domain. When accessed in a web browser, the user will be automatically signed in to Amazon SageMaker Studio, and granted access to all of the Apps and files associated with the Domain's Amazon Elastic File System (EFS) volume. This operation can only be called when the authentication mode equals IAM. </p> <note> <p>The URL that you get from a call to <code>CreatePresignedDomainUrl</code> is valid only for 5 minutes. If you try to use the URL after the 5-minute limit expires, you are directed to the AWS console sign-in page.</p> </note>"
     },
     "CreatePresignedNotebookInstanceUrl":{
       "name":"CreatePresignedNotebookInstanceUrl",
@@ -1937,6 +1937,13 @@
       "max":63,
       "pattern":"^[a-zA-Z0-9](-*[a-zA-Z0-9])*"
     },
+    "AppNetworkAccessType":{
+      "type":"string",
+      "enum":[
+        "PublicInternetOnly",
+        "VpcOnly"
+      ]
+    },
     "AppSortKey":{
       "type":"string",
       "enum":["CreationTime"]
@@ -2172,7 +2179,7 @@
       "members":{
         "S3DataSource":{
           "shape":"AutoMLS3DataSource",
-          "documentation":"<p>The Amazon S3 location of the input data.</p> <note> <p>The input data must be in CSV format and contain at least 1000 rows.</p> </note>"
+          "documentation":"<p>The Amazon S3 location of the input data.</p> <note> <p>The input data must be in CSV format and contain at least 500 rows.</p> </note>"
         }
       },
       "documentation":"<p>The data source for the Autopilot job.</p>"
@@ -3025,7 +3032,7 @@
         },
         "ModelDataUrl":{
           "shape":"Url",
-          "documentation":"<p>The S3 path where the model artifacts, which result from model training, are stored. This path must point to a single gzip compressed tar archive (.tar.gz suffix). The S3 path is required for Amazon SageMaker built-in algorithms, but not if you use your own algorithms. For more information on built-in algorithms, see <a href=\"https://docs.aws.amazon.com/sagemaker/latest/dg/sagemaker-algo-docker-registry-paths.html\">Common Parameters</a>. </p> <p>If you provide a value for this parameter, Amazon SageMaker uses AWS Security Token Service to download model artifacts from the S3 path you provide. AWS STS is activated in your IAM user account by default. If you previously deactivated AWS STS for a region, you need to reactivate AWS STS for that region. For more information, see <a href=\"https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_temp_enable-regions.html\">Activating and Deactivating AWS STS in an AWS Region</a> in the <i>AWS Identity and Access Management User Guide</i>.</p> <important> <p>If you use a built-in algorithm to create a model, Amazon SageMaker requires that you provide a S3 path to the model artifacts in <code>ModelDataUrl</code>.</p> </important>"
+          "documentation":"<p>The S3 path where the model artifacts, which result from model training, are stored. This path must point to a single gzip compressed tar archive (.tar.gz suffix). The S3 path is required for Amazon SageMaker built-in algorithms, but not if you use your own algorithms. For more information on built-in algorithms, see <a href=\"https://docs.aws.amazon.com/sagemaker/latest/dg/sagemaker-algo-docker-registry-paths.html\">Common Parameters</a>. </p> <note> <p>The model artifacts must be in an S3 bucket that is in the same region as the model or endpoint you are creating.</p> </note> <p>If you provide a value for this parameter, Amazon SageMaker uses AWS Security Token Service to download model artifacts from the S3 path you provide. AWS STS is activated in your IAM user account by default. If you previously deactivated AWS STS for a region, you need to reactivate AWS STS for that region. For more information, see <a href=\"https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_temp_enable-regions.html\">Activating and Deactivating AWS STS in an AWS Region</a> in the <i>AWS Identity and Access Management User Guide</i>.</p> <important> <p>If you use a built-in algorithm to create a model, Amazon SageMaker requires that you provide a S3 path to the model artifacts in <code>ModelDataUrl</code>.</p> </important>"
         },
         "Environment":{
           "shape":"EnvironmentMap",
@@ -3245,7 +3252,7 @@
         },
         "InputDataConfig":{
           "shape":"AutoMLInputDataConfig",
-          "documentation":"<p>Similar to InputDataConfig supported by Tuning. Format(s) supported: CSV. Minimum of 1000 rows.</p>"
+          "documentation":"<p>Similar to InputDataConfig supported by Tuning. Format(s) supported: CSV. Minimum of 500 rows.</p>"
         },
         "OutputDataConfig":{
           "shape":"AutoMLOutputDataConfig",
@@ -3380,11 +3387,11 @@
         },
         "SubnetIds":{
           "shape":"Subnets",
-          "documentation":"<p>The VPC subnets to use for communication with the EFS volume.</p>"
+          "documentation":"<p>The VPC subnets that Studio uses for communication.</p>"
         },
         "VpcId":{
           "shape":"VpcId",
-          "documentation":"<p>The ID of the Amazon Virtual Private Cloud (VPC) to use for communication with the EFS volume.</p>"
+          "documentation":"<p>The ID of the Amazon Virtual Private Cloud (VPC) that Studio uses for communication.</p>"
         },
         "Tags":{
           "shape":"TagList",
@@ -3393,6 +3400,10 @@
         "HomeEfsFileSystemKmsKeyId":{
           "shape":"KmsKeyId",
           "documentation":"<p>The AWS Key Management Service (KMS) encryption key ID. Encryption with a customer master key (CMK) is not supported.</p>"
+        },
+        "AppNetworkAccessType":{
+          "shape":"AppNetworkAccessType",
+          "documentation":"<p>Specifies the VPC used for non-EFS traffic. The default value is <code>PublicInternetOnly</code>.</p> <ul> <li> <p> <code>PublicInternetOnly</code> - Non-EFS traffic is through a VPC managed by Amazon SageMaker, which allows direct internet access</p> </li> <li> <p> <code>VpcOnly</code> - All Studio traffic is through the specified VPC and subnets</p> </li> </ul>"
         }
       }
     },
@@ -5346,15 +5357,19 @@
         },
         "SubnetIds":{
           "shape":"Subnets",
-          "documentation":"<p>Security setting to limit to a set of subnets.</p>"
+          "documentation":"<p>The VPC subnets that Studio uses for communication.</p>"
         },
         "Url":{
           "shape":"String1024",
           "documentation":"<p>The domain's URL.</p>"
         },
         "VpcId":{
           "shape":"VpcId",
-          "documentation":"<p>The ID of the Amazon Virtual Private Cloud.</p>"
+          "documentation":"<p>The ID of the Amazon Virtual Private Cloud (VPC) that Studio uses for communication.</p>"
+        },
+        "AppNetworkAccessType":{
+          "shape":"AppNetworkAccessType",
+          "documentation":"<p>Specifies the VPC used for non-EFS traffic. The default value is <code>PublicInternetOnly</code>.</p> <ul> <li> <p> <code>PublicInternetOnly</code> - Non-EFS traffic is through a VPC managed by Amazon SageMaker, which allows direct internet access</p> </li> <li> <p> <code>VpcOnly</code> - All Studio traffic is through the specified VPC and subnets</p> </li> </ul>"
         }
       }
     },
@@ -10547,7 +10562,7 @@
         },
         "ModelDataUrl":{
           "shape":"Url",
-          "documentation":"<p>The Amazon S3 path where the model artifacts, which result from model training, are stored. This path must point to a single <code>gzip</code> compressed tar archive (<code>.tar.gz</code> suffix).</p>"
+          "documentation":"<p>The Amazon S3 path where the model artifacts, which result from model training, are stored. This path must point to a single <code>gzip</code> compressed tar archive (<code>.tar.gz</code> suffix).</p> <note> <p>The model artifacts must be in an S3 bucket that is in the same region as the model package.</p> </note>"
         },
         "ProductId":{
           "shape":"ProductId",
@@ -12872,7 +12887,7 @@
         },
         "S3OutputPath":{
           "shape":"S3Uri",
-          "documentation":"<p>When <code>NotebookOutputOption</code> is <code>Allowed</code>, the Amazon S3 bucket used to save the notebook cell output. If <code>S3OutputPath</code> isn't specified, a default bucket is used.</p>"
+          "documentation":"<p>When <code>NotebookOutputOption</code> is <code>Allowed</code>, the Amazon S3 bucket used to save the notebook cell output.</p>"
         },
         "S3KmsKeyId":{
           "shape":"KmsKeyId",
@@ -12943,7 +12958,7 @@
       "members":{
         "ModelDataUrl":{
           "shape":"Url",
-          "documentation":"<p>The Amazon S3 path where the model artifacts, which result from model training, are stored. This path must point to a single <code>gzip</code> compressed tar archive (<code>.tar.gz</code> suffix).</p>"
+          "documentation":"<p>The Amazon S3 path where the model artifacts, which result from model training, are stored. This path must point to a single <code>gzip</code> compressed tar archive (<code>.tar.gz</code> suffix).</p> <note> <p>The model artifacts must be in an S3 bucket that is in the same region as the algorithm.</p> </note>"
         },
         "AlgorithmName":{
           "shape":"ArnOrName",
@@ -14417,7 +14432,7 @@
         },
         "TransformJob":{
           "shape":"TransformJob",
-          "documentation":"<p>Information about a transform job that's the source of the trial component.</p>"
+          "documentation":"<p>Information about a transform job that's the source of a trial component.</p>"
         }
       },
       "documentation":"<p>Detailed information about the source of a trial component. Either <code>ProcessingJob</code> or <code>TrainingJob</code> is returned.</p>"
