Security and permissions
While some data is not sensitive, most companies would not want to expose their data to the public during the labeling process. In this section, we'll cover data access control, encryption, and workforce management for data labeling.
You should follow the principle of least-privileged access when using Ground Truth (or any other cloud service). Restrict the users who are allowed to create labeling jobs, and restrict users allowed to create labeling jobs using non-private workforces. In a custom labeling job, explicitly provide invoke permissions to your Lambda functions. Restrict labeling job access to only the appropriate S3 buckets and prefixes.
When you run a labeling job, Ground Truth will always encrypt the output in S3. You can use the S3-managed key or provide your own KMS key. For non-sensitive data, the default S3 managed key is adequate. If you have sensitive data, consider using separate KMS keys for different datasets, as that provides...
