GroundTruth IP restriction for labeling jobs and VPC enhancements

When you enable IP restrictions for Amazon SageMaker Ground Truth labeling jobs, there are a couple of ways to specify the allowed IP ranges for workers:

1. For a workforce: You can use the UpdateWorkforce operation to restrict workers to specific IP address ranges (CIDRs). This applies to the entire workforce and allows you to specify up to 10 CIDR values. Workers attempting to access tasks from IP addresses outside these ranges will be denied access and receive an HTTP 204 No Content error message on the worker portal.

2. For individual work teams: The command you executed updates the work team configuration to enable IP restrictions for presigned URLs. However, this doesn't directly specify the allowed IP ranges. Instead, it enables the feature to use the worker's IP address when generating the presigned URL.

To specify the actual IP ranges allowed for your workers, you need to take additional steps:

1. If you want to restrict access for the entire workforce, use the UpdateWorkforce operation and provide the CIDR blocks for the allowed IP ranges.

2. If you're using a private workforce with a VPC configuration, ensure that your VPC is properly configured to allow traffic from the desired IP ranges. The VPC configuration will determine which IP addresses are allowed to access the worker portal.

3. If you're using a public workforce or don't have a VPC configuration, you may need to implement additional network controls or firewall rules on your end to ensure that only workers from the desired IP ranges can access the SageMaker Ground Truth tasks.

Remember that the IP restriction feature works best when there's a consistent IP address used by workers accessing both SageMaker Ground Truth and the S3 objects. If your workers use dynamic IP addresses or access through NAT layers or VPNs, you may encounter issues with this feature.

If you're having trouble implementing these restrictions or need to specify more granular IP ranges, you may want to consider using Amazon VPC mode for your private worker portal, which provides more control over network access.
Sources
Use IP-restricted presigned URLs to enhance security in Amazon SageMaker Ground Truth | AWS Machine Learning Blog
Restrict worker access to tasks to allowable IP addresses - Amazon SageMaker
Use Amazon VPC Mode from a Private Worker Portal - Amazon SageMaker
IamPolicyConstraints - Amazon SageMaker

Hello,

I see can that you are trying to implement the security enhancements outlined in the article[1]for SageMaker Ground Truth.I can also see that you executed the command to update your work team as recommended and you enabled  S3Presign ("SourceIp": "Enabled”), but you are not sure where to specify the IP range allowed for the presigned URLs.

“By default, a workforce isn't restricted to specific IP addresses. You can use the UpdateWorkforce operation to require that workers use a specific range of IP addresses (CIDRs) to access tasks. If you specify one or more CIDRs, workers who attempt to access tasks using any IP address outside the specified ranges are denied and will get a HTTP 204 No Content error message on the worker portal. You can specify up to 10 CIDR values using UpdateWorkforce”.[2]

UpdateWorkforce -“Use SourceIpConfig to restrict worker access to tasks to a specific range of IP addresses. You specify allowed IP addresses by creating a list of up to ten CIDRs. By default, a workforce isn't restricted to specific IP addresses. If you specify a range of IP addresses, workers who attempt to access tasks using any IP address outside the specified range are denied and get a Not Found error message on the worker portal”.[3]

“After you have restricted your workforce to one or more CIDRs, the output of UpdateWorkforce lists all allowable CIDRs. You can also use the DescribeWorkforce operation to view all allowable CIDRs for a workforce”.[2]

Reference: [1] https://aws.amazon.com/blogs/machine-learning/use-ip-restricted-presigned-urls-to-enhance-security-in-amazon-sagemaker-ground-truth/ [2] https://docs.aws.amazon.com/sagemaker/latest/dg/sms-workforce-management-private-api-cidr.html [3] https://docs.aws.amazon.com/sagemaker/latest/APIReference/API_UpdateWorkforce.html