sagemaker domain and user security group and iam roles

Question

I have sagemaker domain configured in vpc only(with endpoints and nat gateway configured) mode in my private subnet it is working fine at present but i want to limit security group permissions and iam role policies, at present my sagemaker domain security group allow all inbound port from 0.0.0.0/0  for inbound, how to follow best pratice for sagemaker domain security group, iam roles,    also i am using iam role used in sagemaker domain for all users created in it. Please suggest best practices

Mi_Sha · Answer

For Studio (domain) please check this resource: https://docs.aws.amazon.com/whitepapers/latest/sagemaker-studio-admin-best-practices/permissions-management.html
For network best practices: https://docs.aws.amazon.com/sagemaker/latest/dg/infrastructure-connect-to-resources.html

Oleksandr Hanhaliuk · Answer

The best practice is to deny all, except IP/ports that you need to access

sagemaker domain and user security group and iam roles

Relevant content