Fundamental steps to secure AI workloads on AWS

Secure AI workloads on AWS by applying least‑privilege IAM, VPC endpoints, encryption, logging, and secret management. 1. Create an IAM role with only required SageMaker permissions: ```bash aws iam create-role \ --role-name SageMakerSecureRole \ --assume-role-policy-document file://trust-policy.json aws iam attach-role-policy \ --role-name SageMakerSecureRole \ --policy-arn arn:aws:iam::aws:policy/AmazonSageMakerFullAccess ``` 2. Restrict network access with a VPC endpoint: ```bash aws ec2 create-vpc-endpoint \ --vpc-id vpc-0123abcd \ --service-name com.amazonaws..sagemaker \ --subnet-ids subnet-abc123 subnet-def456 \ --security-group-ids sg-0a1b2c3d ``` 3. Enable encryption at rest for model artifacts: ```bash aws sagemaker create-model \ --model-name SecureModel \ --primary-container Image=...,ModelDataUrl=...,EncryptionKeyId=arn:aws:kms:...:key/... ``` 4. Turn on CloudWatch logs for monitoring: ```bash aws sagemaker update-notebook-instance \ --notebook-instance-name MyNotebook \ --default-code-repository \ --enable-cloudwatch-logs ``` 5. Store API tokens in Secrets Manager and reference them in code: ```bash aws secretsmanager create-secret \ --name SageMakerAPIToken \ --secret-string "{\"token\":\"YOUR_TOKEN\"}" ``` **Gotcha:** Forgetting to attach the policy to the IAM role will cause SageMaker API calls to fail with AccessDenied errors.