Patched code sample

import os
import json

# This code represents the logic fixed in the Amazon SageMaker Python SDK.
# The CVE describes a vulnerability where a sensitive HMAC signing key was
# stored in cleartext as a container environment variable. An authenticated
# user could then call the SageMaker DescribeModel API and extract this key.
#
# The fix involves storing the key in a secure location (like AWS Secrets Manager)
# and passing only a non-sensitive reference (the secret's ARN) to the
# container environment. The container, with appropriate IAM permissions, can
# then fetch the key at runtime without it ever being exposed via API responses.

class FixedModelBuilder:
    """
    A conceptual representation of the fixed ModelBuilder component.
    """
    def __init__(self, image_uri, model_s3_path):
        self.image_uri = image_uri
        self.model_s3_path = model_s3_path

    def get_container_definition(self, hmac_key_secret_arn: str) -> dict:
        """
        Generates a secure container definition for a SageMaker Model.

        This method demonstrates the fix. Instead of accepting a cleartext key,
        it accepts the ARN of a secret stored in AWS Secrets Manager.

        Args:
            hmac_key_secret_arn (str): The ARN of the secret containing the
                                       HMAC key.

        Returns:
            dict: A dictionary representing the container definition, which can be
                  safely used in the SageMaker CreateModel API call.
        """
        # --- VULNERABLE (OLD) APPROACH (for context) ---
        # The previous, vulnerable code would have done something like this:
        #
        # def get_vulnerable_container_definition(self, cleartext_hmac_key: str):
        #     return {
        #         'Image': self.image_uri,
        #         'ModelDataUrl': self.model_s3_path,
        #         'Environment': {
        #             # THIS IS THE VULNERABILITY: The key is exposed in cleartext.
        #             'SAGEMAKER_MODEL_SERVER_SIGNATURE_KEY': cleartext_hmac_key
        #         }
        #     }
        #
        # Calling DescribeModel on a model created this way would reveal the key.

        # --- FIXED (NEW) APPROACH ---
        # The environment now contains only a non-sensitive reference to the secret.
        # The inference container's execution role must be granted permission to
        # call `secretsmanager:GetSecretValue` on this specific secret ARN.
        secure_environment = {
            'SIGNATURE_KEY_SECRET_ARN': hmac_key_secret_arn
        }

        # The inference script inside the container is responsible for using this
        # ARN to fetch the actual key at runtime. For example:
        #
        # import boto3
        # secret_arn = os.environ.get('SIGNATURE_KEY_SECRET_ARN')
        # secrets_client = boto3.client('secretsmanager')
        # secret_response = secrets_client.get_secret_value(SecretId=secret_arn)
        # hmac_key = secret_response['SecretString']
        # # ... proceed with key usage ...

        return {
            'Image': self.image_uri,
            'ModelDataUrl': self.model_s3_path,
            'Environment': secure_environment
        }


# --- Demonstration of the Fixed Code ---

# 1. Define placeholders. In a real scenario, the HMAC key would be created
#    and stored in AWS Secrets Manager beforehand.
IMAGE_URI = "123456789012.dkr.ecr.us-east-1.amazonaws.com/my-inference-image:latest"
MODEL_S3_PATH = "s3://my-model-bucket/artifacts/model.tar.gz"
HMAC_KEY_SECRET_ARN = "arn:aws:secretsmanager:us-east-1:123456789012:secret:sagemaker/my-model-hmac-key-a1b2c3"

# 2. Instantiate the fixed builder.
builder = FixedModelBuilder(image_uri=IMAGE_URI, model_s3_path=MODEL_S3_PATH)

# 3. Generate the secure container definition using the secret's ARN.
#    Note that the cleartext key is never passed to or handled by the builder.
secure_container_definition = builder.get_container_definition(
    hmac_key_secret_arn=HMAC_KEY_SECRET_ARN
)

# 4. Print the resulting container definition. This is the object that would be
#    passed to the SageMaker CreateModel API.
#    Notice it contains no sensitive information, only the ARN.
print(json.dumps(secure_container_definition, indent=2))