AWS sagemaker-unified-studio documentation change
Summary
Updated troubleshooting section from Lake Formation permissions to subscription-related issues. Added specific guidance about IAM role trust relationships, Lake Formation registration modes, KMS/S3 encryption requirements, and clarified error resolutions.
Security assessment
The changes focus on proper IAM role configuration and Lake Formation permissions management, which are security best practices but do not indicate a specific vulnerability being patched. Added guidance about avoiding IAMAllowedPrincipals and encryption requirements improves security documentation.
Diff
diff --git a/sagemaker-unified-studio/latest/userguide/troubleshooting-issues.md b/sagemaker-unified-studio/latest/userguide/troubleshooting-issues.md index 125395c41..57cc04075 100644 --- a//sagemaker-unified-studio/latest/userguide/troubleshooting-issues.md +++ b//sagemaker-unified-studio/latest/userguide/troubleshooting-issues.md @@ -5 +5 @@ -Troubleshooting AWS Lake Formation permissions for Amazon SageMaker Unified StudioAmazon EBS Volume Depletion with Local Notebook Execution Domain SAML Identity Provider Email Issue Project Creation Failure Data Explorer Visibility Issue Data Catalog Visibility Issue Connection to Amazon RDS MySQL in Existing VPC Visual ETL Flow Column Selection Invalid or expired auth token when accessing an IDE JupyterLab Configure Magic Error +Troubleshooting issues related to subscriptions in Amazon SageMaker Unified StudioAmazon EBS Volume Depletion with Local Notebook Execution Domain SAML Identity Provider Email Issue Project Creation Failure Data Explorer Visibility Issue Data Catalog Visibility Issue Connection to Amazon RDS MySQL in Existing VPC Visual ETL Flow Column Selection Invalid or expired auth token when accessing an IDE JupyterLab Configure Magic Error @@ -9 +9 @@ Troubleshooting AWS Lake Formation permissions for Amazon SageMaker Unified Stud -## Troubleshooting AWS Lake Formation permissions for Amazon SageMaker Unified Studio +## Troubleshooting issues related to subscriptions in Amazon SageMaker Unified Studio @@ -11 +11 @@ Troubleshooting AWS Lake Formation permissions for Amazon SageMaker Unified Stud -This section contains troubleshooting instructions for issues that you might encounter when you [Configure Lake Formation permissions for Amazon SageMaker Unified Studio](./lake-formation-permissions-for-amazon-sagemaker-unified-studio.html). +This topic contains troubleshooting instructions for issues that you might have when subscribing to assets in Amazon SageMaker Unified Studio. @@ -15 +15 @@ Error message | Resolution -Unable to assume the IAM role. | This error is thrown when Amazon SageMaker Unified Studio is not able to assume the IAM role needed for updating AWS Lake Formation permissions. To fix the issue, go to the IAM console in the account where your data asset exists and make sure that the the IAM role you see in the error message has a trust relationship with the Amazon DataZone service principal. +Unable to assume the IAM role `role-arn`. | This error occurs when Amazon SageMaker Unified Studio cannot assume the IAM role needed for creating permissions to grant access to assets. To fix the issue, go to the AWS Identity and Access Management console in the account where your data asset exists and ensure the IAM role in the error message has a trust relationship with Amazon DataZone service principal as shown in the following policy. @@ -35,4 +35,3 @@ Unable to assume the IAM role. | This error is thrown when Amazon SageMaker Un -The IAM role `role-arn` does not have the necessary permissions to read the metadata of the asset you are trying to subscribe to. | This error is thrown when Amazon SageMaker Unified Studio is able to assume the IAM role but the role does not have the necessary permissions. To fix the issue, go to the IAM console in the account where your data asset exists and make sure that the role you see in the error message has the [SageMakerStudioProjectUserRolePolicy](https://docs.aws.amazon.com/sagemaker-unified-studio/latest/adminguide/security-iam-awsmanpol-SageMakerStudioProjectUserRolePolicy.html) attached to it. -Asset is a resource link. Amazon SageMaker Unified Studio does not support subscriptions to resource links. | This error is thrown when the asset you are trying to publish to Amazon SageMaker Unified Studio is a resource link to an AWS Glue table. -Asset is not managed by AWS Lake Formation. | This error means that the AWS Lake Formation permissions are not enforced on the asset you are trying to publish. This can happen because the Amazon S3 location of the asset is not registered in AWS Lake Formation. To fix the issue, log into the AWS Lake Formation console in the account where the table exists and register the Amazon S3 location in AWS Lake Formation mode or hybrid mode. -IAM role `role-name` does not have necessary AWS Lake Formation permissions to grant access to this asset. | This error means that the IAM role in the error message does not have the necessary permissions for Amazon SageMaker Unified Studio to be able to manage permissions on the published table. You can resolve the issue by granting the following AWS Lake Formation permissions to the the IAM role on the table you are looking to publish. +The IAM role `role-arn` does not have the necessary permissions to read the metadata of the asset you are trying to subscribe to. | This error occurs when Amazon SageMaker Unified Studio is able to assume the IAM role but the role does not have the necessary permissions. To fix this issue, go to the IAM console in the account where your data asset exists and make sure that the role you see in the error message has the [SageMakerStudioProjectUserRolePolicy](https://docs.aws.amazon.com/sagemaker-unified-studio/latest/adminguide/security-iam-awsmanpol-SageMakerStudioProjectUserRolePolicy.html) attached to it. +Asset is a resource link. Amazon SageMaker Unified Studio does not support subscriptions to resource links. | This error occurs because you cannot subscribe to AWS Glue table resource links in Amazon SageMaker Unified Studio. Choose a different asset type. +Asset is not managed by Lake Formation. | This error occurs when the AWS Lake Formation permissions are not enforced on the asset you are trying to publish. This happens because the Amazon S3 location of the asset is not registered in Lake Formation. @@ -40,2 +39,13 @@ IAM role `role-name` does not have necessary AWS Lake Formation permissions to g - 1. `Describe` and `Describe Grantable` permissions on the database where the tables exist - 2. `Describe`, `Select`, `Describe Grantable`, and `Select Grantable` permissions on the all the tables in the above database that you want Amazon SageMaker Unified Studio to manage access for on your behalf. + * To fix the issue, log into the Lake Formation console in the account where the table exists. + * Register the Amazon S3 location in **Lake Formation mode** or **Hybrid mode**. + * Ensure that the `IAMAllowedPrincipals` group is not added in the table's Lake Formation permissions. + +###### Note + +If you use encrypted Amazon S3 buckets or cross-account setups, you may need to adjust your AWS KMS and S3 settings. For more information, see [Adding an Amazon S3 location to your data lake](https://docs.aws.amazon.com/lake-formation/latest/dg/register-data-lake.html) + + +IAM role `role-name` does not have necessary Lake Formation permissions to grant access to this asset. | This error occurs when the IAM role in the error message does not have the necessary permissions for Amazon SageMaker Unified Studio to manage permissions on the published table. You can resolve the issue by granting the following AWS Lake Formation permissions to the the IAM role on the table you are looking to publish. + + 1. `Grant Describe` and `Describe Grantable` on the database where the tables exist. + 2. `Describe`, `Select`, `Describe Grantable`, and `Select Grantable` on the all the tables in the above database that you want Amazon SageMaker Unified Studio to manage access on your behalf.