search

nccgroup / PMapper

A tool for quickly evaluating IAM permissions in AWS.
GNU Affero General Public License v3.0
1.41k stars 169 forks source link

Additional Edges: SageMaker #47

Closed ncc-erik-steringer closed 3 years ago

ncc-erik-steringer commented 4 years ago

(EDIT: Separating things out into separate issues).

Amazon SageMaker is a service for data scientists. It includes several features, among which include creating compute resources that can access IAM Roles. Therefore we should look for and report any potential ways for users/roles given sagemaker:* + iam:PassRole permissions to access other IAM Roles.

Need to also review if container-related services are necessary.

ncc-erik-steringer commented 3 years ago

CreateNotebookInstance - Creates a notebook instance and takes a parameter RoleArn to let the notebook instance call the AWS API.

Done: 25ddb89

ncc-erik-steringer commented 3 years ago

CreateProcessingJob - Runs a docker container with user-defined code to process data. Takes a RoleArn param too.

Done: 4cb8c847

ncc-erik-steringer commented 3 years ago

CreateTrainingJob - Starts a model training job. Need to verify if user-defined code is ran. Takes a RoleArn param.

Done: 4cb8c847

ncc-erik-steringer commented 3 years ago

CreateUserProfile - Creates a user within a domain (CreateDomain sets defaults), includes an ExecutionRole param.

Kicking this can down the road.