AWS sagemaker-unified-studio documentation change
Summary
Updated documentation for Amazon SageMaker Unified Studio's Redshift compute prerequisites, including changes to access procedures, tag requirements, and IAM role configurations. Added details about VPC requirements and project ID usage.
Security assessment
The changes primarily focus on improving documentation clarity and adding details about access control mechanisms (tags, IAM roles, and VPC requirements). While these changes involve security-related features like access control and IAM roles, there is no evidence of addressing a specific security vulnerability or incident. The documentation does add information about security features like IAM role configurations and access control tags.
Diff
diff --git a/sagemaker-unified-studio/latest/userguide/compute-prerequisite-redshift.md index 3c2f18a7e..01342a74e 100644 --- a/sagemaker-unified-studio/latest/userguide/compute-prerequisite-redshift.md +++ b/sagemaker-unified-studio/latest/userguide/compute-prerequisite-redshift.md @@ -4,0 +5,2 @@ +Gaining access to resources in the same accountGaining access to resources in a different account + @@ -9 +11 @@ Amazon SageMaker Unified Studio is in preview release and is subject to change. -In order to add Amazon SageMaker Unified Studio connections to existing compute resources, you must get access information from the admin that owns the resources. To do this, first get your project role ARN. Then, send the arn to your admin and receive access details from them. +To add Amazon SageMaker Unified Studio connections to existing compute resources, you must get access information from the admin that owns the resources. To do this, first get your project ID from the **Project overview** page of the project you want to add resources to. Then, send the project ID to the owner of the Amazon Redshift resources. The Amazon Redshift admin uses the project ID to complete some steps so that you receive access details from them, and then you can input the access information in Amazon SageMaker Unified Studio. @@ -13 +15,9 @@ You and the admin must complete different steps depending on whether the resourc -For compute resources in the same account, complete the following steps: +###### Note + +If you want to query the Amazon Redshift resources using JuypterLab within Amazon SageMaker Unified Studio, the Amazon Redshift resource must use the same VPC as the Amazon SageMaker Unified Studio project. If the Amazon SageMaker Unified Studio project uses a different VPC than the Amazon Redshift resource you want to gain access to, you and your admin must complete additional steps to connect the VPCs before you can use JupyterLab to query. You can still query using the Data page of your project if you are using different VPCs. For more information, see [VPC to VPC connectivity](https://docs.aws.amazon.com/whitepapers/latest/building-scalable-secure-multi-vpc-network-infrastructure/vpc-to-vpc-connectivity.html) and [Connect VPCs using VPC peering](https://docs.aws.amazon.com/vpc/latest/userguide/vpc-peering.html). + +## Gaining access to resources in the same account + +In some cases, the Amazon Redshift resource you want to add to your Amazon SageMaker Unified Studio project might be in the same account as your project. + +###### For compute resources in the same account as your Amazon SageMaker Unified Studio project, complete the following steps: @@ -15 +25 @@ For compute resources in the same account, complete the following steps: - 1. Send the admin the project role ARN. + 1. Send the Amazon Redshift admin the project ID. This can be found on the **Project overview** page of your Amazon SageMaker Unified Studio project. @@ -17 +27 @@ For compute resources in the same account, complete the following steps: - 2. The admin then adds 2 tags to the Amazon Redshift cluster or workgroup that you want to add to Amazon SageMaker Unified Studio. + 2. The admin then adds 1 of the following tags to the Amazon Redshift cluster or workgroup that you want to add to Amazon SageMaker Unified Studio. @@ -19 +29 @@ For compute resources in the same account, complete the following steps: - * For tag 1, the key is **DatazoneEnvironmentProjectId**. The value is from the project role, for example: _ab1234c5d67efg ._ + * Option 1: Add a tag to allow only a specific Amazon SageMaker Unified Studio project to access it: `AmazonDataZoneProject=`projectID``. @@ -21 +31 @@ For compute resources in the same account, complete the following steps: - * For tag 2, the key is **DataZoneScopeName**. The****value is the last part of the project role, for example:_dev_. + * Option 2: Add a tag to allow all Amazon SageMaker Unified Studio projects in this account to access it: `for-use-with-all-datazone-projects=true`. @@ -23 +33 @@ For compute resources in the same account, complete the following steps: - 3. The admin then must send you the following information: + 3. The admin then must send you a username and password for a database user that has access to the compute resources. @@ -25 +34,0 @@ For compute resources in the same account, complete the following steps: - * A username and password for a user role that has access to the compute resources. @@ -27 +35,0 @@ For compute resources in the same account, complete the following steps: - * A JDBC URL. For more information about JDBC connections, see [Connecting to Amazon Redshift Serverless through JDBC drivers](https://docs.aws.amazon.com/redshift/latest/mgmt/serverless-connecting.html#serverless-connecting-driver) and [Getting the JDBC URL](https://docs.aws.amazon.com/redshift/latest/mgmt/jdbc20-obtain-url.html) in the in the Amazon Redshift Management Guide. @@ -29,0 +38 @@ For compute resources in the same account, complete the following steps: +You can then use the username and password to add the compute connection in Amazon SageMaker Unified Studio. For more information, see [Connecting to an existing Amazon Redshift resource](./adding-a-existing-compute-connection.html). @@ -30,0 +40 @@ For compute resources in the same account, complete the following steps: +## Gaining access to resources in a different account @@ -32 +42 @@ For compute resources in the same account, complete the following steps: -You can then use the username, password, and JDBC URL to add the compute connection in Amazon SageMaker Unified Studio. +In some cases, the Amazon Redshift resource you want to add to your Amazon SageMaker Unified Studio project might be in a different AWS account than your project. @@ -34 +44 @@ You can then use the username, password, and JDBC URL to add the compute connect -For compute resources in a different account, complete the following steps: +###### For compute resources in a different account, complete the following steps: @@ -36 +46 @@ For compute resources in a different account, complete the following steps: - 1. Send the admin the project role ARN. + 1. Send the Amazon Redshift admin the following information from the **Project overview** page of your Amazon SageMaker Unified Studio project: @@ -38 +48 @@ For compute resources in a different account, complete the following steps: - 2. The admin must create an access role for Amazon SageMaker Unified Studio that can be used to query Amazon Redshift and contains the following tags: + * The Amazon SageMaker Unified Studio project role ARN. @@ -40 +50 @@ For compute resources in a different account, complete the following steps: - for-use-with-sagemaker-unified-studio=true + * The Amazon SageMaker Unified Studio project ID. @@ -42 +52 @@ For compute resources in a different account, complete the following steps: - RedshiftDbUser= (if using federated user) + * The Amazon SageMaker Unified Studio project domain ID. @@ -44 +54 @@ For compute resources in a different account, complete the following steps: - 3. An example Amazon Redshift access role for Amazon SageMaker Unified Studio is provided below: + 2. The admin must create an access role for Amazon SageMaker Unified Studio that can be used to query Amazon Redshift. @@ -46 +56,3 @@ For compute resources in a different account, complete the following steps: - # Sample permission policy of an access role to query RedShift +An example Amazon Redshift access role for Amazon SageMaker Unified Studio is provided below: + + # Sample permission policy of access role to query Redshift @@ -48,12 +60,2 @@ For compute resources in a different account, complete the following steps: - "Sid": "DataExplorerPermissions", - "Effect": "Allow", - "Action": [ - "redshift-data:GetStatementResult", - "redshift-data:CancelStatement", - "redshift-data:DescribeStatement", - "redshift-data:ListDatabases", - "redshift-data:ListSchemas", - "redshift-data:ListTables" - ], - "Resource": "*" - }, + "Version": "2012-10-17", + "Statement": [ @@ -64,0 +67 @@ For compute resources in a different account, complete the following steps: + "redshift:GetClusterCredentials", @@ -94 +97 @@ For compute resources in a different account, complete the following steps: - "<secret_arn>" + "secret_arn" @@ -106,0 +110,3 @@ For compute resources in a different account, complete the following steps: + ] + } + @@ -110 +116,4 @@ The trust policy is as follows: - # trust policy of the access role + # trust policy of access role + { + "Version": "2012-10-17", + "Statement": [ @@ -114 +123 @@ The trust policy is as follows: - "AWS": "<project_role_arn>" + "AWS": "project-role-arn" @@ -116 +125,5 @@ The trust policy is as follows: - "Action": ["sts:AssumeRole","sts:SetSourceIdentity","sts:TagSession"] + "Action": "sts:AssumeRole", + "Condition": { + "StringEquals": { + "sts:ExternalId": "project-id" + } @@ -117,0 +131,35 @@ The trust policy is as follows: + }, + { + "Effect": "Allow", + "Principal": { + "AWS": "project-role-arn" + }, + "Action": [ + "sts:SetSourceIdentity" + ], + "Condition": { + "StringLike": { + "sts:SourceIdentity": "${aws:PrincipalTag/datazone:userId}" + } + } + }, + { + "Effect": "Allow", + "Principal": { + "AWS": "project-role-arn" + }, + "Action": "sts:TagSession", + "Condition": { + "StringEquals": { + "aws:RequestTag/AmazonDataZoneProject": "project-id", + "aws:RequestTag/AmazonDataZoneDomain": "domain-id" + } + } + } + ] + } + + + 3. (Optional) If you want to use IAM credentials to access the Amazon Redshift resource, rather than an AWS Secrets Manager secret, the admin must add the following tag to the access role: + + RedshiftDbUser=Username @@ -123 +171 @@ The trust policy is as follows: - * Use a temporary username and password. This is generated from the access role credentials. + * Use a temporary username and password. This is generated from the IAM access role credentials. @@ -125 +173 @@ The trust policy is as follows: - * The `RedshiftDbUser` tag on the access role is required. This controls the database user role that Amazon SageMaker Unified Studio users assume. For more information, see [Setting up principal tags to connect a cluster or workgroup from query editor v2](https://docs.aws.amazon.com/redshift/latest/mgmt/query-editor-v2-getting-started.html#query-editor-v2-principal-tags-iam) in the Amazon Redshift Management Guide. + * The `RedshiftDbUser` tag on the access role is required. This determines the federated database user within the databases for the Amazon SageMaker Unified Studio users. For more information, see [Setting up principal tags to connect a cluster or workgroup from query editor v2](https://docs.aws.amazon.com/redshift/latest/mgmt/query-editor-v2-getting-started.html#query-editor-v2-principal-tags-iam) in the Amazon Redshift Management Guide. @@ -138 +186 @@ The trust policy is as follows: -You can then use the access credentials and JDBC URL to add the compute connection in Amazon SageMaker Unified Studio. +You can then use the access credentials and JDBC URL to add the compute connection in Amazon SageMaker Unified Studio. For more information, see [Connecting to an existing Amazon Redshift resource](./adding-a-existing-compute-connection.html).