feat: add aiml-sagemaker-security-assessment skill - #98
Open
aditya-vikram-parakala wants to merge 1 commit into
Open
aditya-vikram-parakala wants to merge 1 commit into
aditya-vikram-parakala wants to merge 1 commit into
Conversation
Add a read-only Amazon SageMaker AI security posture assessment skill that runs 25 checks (SM-01..SM-25) across notebook/domain internet exposure and VPC deployment, KMS encryption at rest, model network isolation, container-repository access mode, endpoint high-availability, Model Monitor / drift detection, GuardDuty coverage, and MLOps governance, producing severity-rated findings and a consolidated report. This is the SageMaker domain of a per-domain AI/ML security posture family. It defers reactive access-denial diagnosis to aiml-access-diagnostics and cites Security Hub control IDs (SageMaker.1-5) as cross-references without calling securityhub. Every check carries a Verifiability classification (Verifiable / Heuristic) so the report never marks an unread or access-denied control as Passed; SM-02's stale-access and IAM Identity Center aspects are prescribe-only and always N/A (no Generate* calls). Register the skill in llms.txt and add a gated read-only inline policy (EnableAIMLSageMakerSecurityAssessment, default true) to the CloudFormation skill policies for the sagemaker List/Describe and guardduty:ListDetectors reads not covered by AIDevOpsAgentAccessPolicy. sim: https://taskei.amazon.dev/tasks/V2372308608
udid-aws
added a commit
that referenced
this pull request
Sep 21, 2026
Adds #97, #98 and #99, which were opened after the last refresh and all touch a skill directory. The documented one-liner used `gh pr diff --name-only`, which fails with HTTP 406 on a diff over 20,000 lines and still exits 0. A pull request that large was therefore dropped from the derivation with no error shown, which is the worst shape for this to fail in: a missing entry means the pull request is enforced when it should be exempt. #97 has 256 files and was missed exactly this way. The command now reads the files endpoint, which has no such limit. Also records that entries are chosen on the factual test -- open, and touches a skill directory -- rather than on whether being listed changes that pull request's outcome. #97 already ships the new layout, so `now_migrated` keeps it enforced and its entry does nothing today; it starts mattering only if that pull request is restructured before merge. Judging entries by outcome is what nearly lost #97 here, so the rule is deliberately the simpler one.
6 tasks
udid-aws
added
ci-sweep
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Adds the
aiml-sagemaker-security-assessmentskill: a read-only Amazon SageMaker AI security posture assessment that runs 25 checks (SM-01..SM-25) across an account, regions, and associated accounts, and produces severity-rated findings plus a consolidated report. The DevOps Agent runs the read-only checks directly; no infrastructure is deployed.This is the SageMaker domain of a per-domain AI/ML security posture family (the Bedrock domain is in PR #78). Coverage: notebook/domain direct-internet exposure and VPC-only deployment, notebook privileged-access settings, KMS encryption at rest (notebooks, models, Feature Store offline store, processing/transform/HPT/compilation/AutoML volumes and output), model network isolation, container-repository (ECR) access mode, endpoint high-availability, Model Monitor / drift detection, GuardDuty coverage, and MLOps governance (Model Registry, approval workflow, lineage).
Owns vs. defers
aiml-access-diagnostics— reactive diagnosis of a specific access denial (authorization-chain tracing). This skill reports static IAM posture only.securityhub:*calls.Verify vs. prescribe (determinism contract)
Every check carries a Verifiability classification so the report never marks an unread control as
Passed:N/A, neverPassed.SM-02mixed — AmazonSageMakerFullAccess detection is Heuristic; its stale-access aspect (needsiam:GenerateServiceLastAccessedDetails, aGenerate*verb blocked by the read-only guardrail) and IAM Identity Center aspect (not control-plane readable) are Prescribe-only and are never markedPassed.Testing
100/100, Grade A, 0 critical / 0 warning / 0 info,passed: true.--runs 3),passed: true(outcome 1.0, process 0.90, style 1.0, efficiency 1.0; classifiedPARETO_BETTER— the skill improves quality while reducing cost).should_trigger:falsenegatives (Bedrock, AgentCore, reactive access-denial, off-topic) do not trigger.should_trigger:trueactivation is implied by the functional pass per CONTRIBUTING; it registers via the Skill tool when the skill is installed in the evaluation environment.cfn-lintoncloudformation/devops-agent-skill-policies.yaml: 0 errors (only pre-existing warnings unrelated to this change).mkdocs build --strictwith the skill staged, on the pinnedmkdocs-material==9.6.14: EXIT 0, 0 warnings; README uses only absolute GitHub URLs.IAM / CloudFormation
Added a gated read-only inline policy
EnableAIMLSageMakerSecurityAssessment(defaulttrue, Condition-gated,SkillPolicySummaryupdated) tocloudformation/devops-agent-skill-policies.yaml. It grants only the reads not covered byAIDevOpsAgentAccessPolicy:sagemaker:List*/Describe*control-plane reads andguardduty:ListDetectors. IAM, EC2, KMS, and S3 reads rideAIDevOpsAgentAccessPolicy. All actions are read-only.SM-02's stale-access and IAM Identity Center aspects are prescribe-only and intentionally not granted (noGenerate*).Taskei
V2372308608 — https://taskei.amazon.dev/tasks/V2372308608
Checklist
versionandauthorin metadatanamein frontmatter matches directory namedescriptionclearly states what/when to activate (≤1024 chars)## 1.0.0, version-synced)passed(100/A) and functionalpassed(0.976, runs=3)llms.txt.skilleval.yamlpresent (canonical STR-016 ignore)--strictsafe)SkillPolicySummaryupdatedmainBy submitting this pull request, I confirm that my contribution is made under the terms of the Apache License 2.0.