Access strategies and security best practices - Amazon SageMaker AI
AnnotationsStrategies
Services or capabilities described in AWS documentation might vary by Region. To see the differences applicable to the AWS European Sovereign Cloud Region, see the AWS European Sovereign Cloud User Guide.

Access strategies and security best practices

An access strategy sets who can reach a Ray cluster's dashboard and Jobs API endpoint. You set it with annotations on the Ray resource.

Annotations

Add the following annotations under metadata.annotations on your Ray resource (RayCluster, RayJob, RayService, or RayCronJob).

metadata:
  annotations:
    access.sagemaker.amazonaws.com/enabled: "true"
    access.sagemaker.amazonaws.com/access-strategy: ray-access-strategy-private

When you add these annotations to a RayJob, RayService, or RayCronJob, they are automatically propagated to the RayCluster created on their behalf. You do not need to annotate the underlying cluster separately.

Strategies

  • ray-access-strategy-private — the default when no strategy annotation is set. Access is scoped to the identity that created the cluster.

  • ray-access-strategy-public — any identity with connect permission in the cluster's namespace can reach the endpoint.

Important

Choose ray-access-strategy-public only when every identity with connect permission in the namespace is meant to have read and write access to the cluster.