AWS next-generation-sagemaker documentation change
Summary
Updated documentation links and minor editorial improvements
Security assessment
Routine documentation maintenance without security-specific content changes
Diff
diff --git a/next-generation-sagemaker/latest/userguide/lakehouse-athena-federated-queries.md b/next-generation-sagemaker/latest/userguide/lakehouse-athena-federated-queries.md index c0a181659..008f6c0a2 100644 --- a//next-generation-sagemaker/latest/userguide/lakehouse-athena-federated-queries.md +++ b//next-generation-sagemaker/latest/userguide/lakehouse-athena-federated-queries.md @@ -7 +7 @@ What you'll learnPrerequisitesStep 1: Set up federated catalogsStep 2: Set up fi -# Get started using Amazon SageMaker Lakehouse integrated access controls for Athena federated queries in Amazon SageMaker Unified Studio +# Get started with SageMaker Lakehouse integrated access controls for Athena federated queries in Amazon SageMaker Unified Studio @@ -20 +20 @@ Scaling data infrastructure creates challenges with data silos, fragmented acces -To address the challenges of data silos and fragmented access, [Amazon SageMaker Lakehouse](https://docs.aws.amazon.com/sagemaker-unified-studio/latest/userguide/lakehouse.html) with integrated access controls for [Amazon Athena](https://docs.aws.amazon.com/athena/latest/ug/what-is.html) (Athena) federated queries offers: +To address the challenges of data silos and fragmented access, [SageMaker Lakehouse](https://docs.aws.amazon.com/sagemaker-unified-studio/latest/userguide/lakehouse.html) with integrated access controls for [Amazon Athena](https://docs.aws.amazon.com/athena/latest/ug/what-is.html) (Athena) federated queries offers: @@ -35 +35 @@ To address the challenges of data silos and fragmented access, [Amazon SageMaker -Amazon SageMaker Lakehouse provides a unified environment for accessing, discovering, preparing, and analyzing data from various sources for machine learning (ML) and analytics workloads. Athena complements this as a serverless query service that analyzes data lake and federated data sources such as [Amazon DynamoDB](https://aws.amazon.com/dynamodb/) and PostgreSQL, through using SQL without extract, transform, and load (ETL) scripts. Federated connections in Amazon SageMaker Lakehouse establish secure links to external data sources, enabling access without data movement. [Federated catalogs](https://docs.aws.amazon.com/lake-formation/latest/dg/federated-catalog-data-connection.html) organize metadata about these connected data sources, making them discoverable and queryable through the Amazon SageMaker Lakehouse interface. Federated queries use these connections to run SQL statements across multiple data sources simultaneously, breaking down data silos for comprehensive analysis. +SageMaker Lakehouse provides a unified environment for accessing, discovering, preparing, and analyzing data from various sources for machine learning (ML) and analytics workloads. Athena complements this as a serverless query service that analyzes data lake and federated data sources such as [Amazon DynamoDB](https://aws.amazon.com/dynamodb/) and PostgreSQL, through using SQL without extract, transform, and load (ETL) scripts. Federated connections in SageMaker Lakehouse establish secure links to external data sources, enabling access without data movement. [Federated catalogs](https://docs.aws.amazon.com/lake-formation/latest/dg/federated-catalog-data-connection.html) organize metadata about these connected data sources, making them discoverable and queryable through the SageMaker Lakehouse interface. Federated queries use these connections to run SQL statements across multiple data sources simultaneously, breaking down data silos for comprehensive analysis. @@ -39 +39 @@ Amazon SageMaker Lakehouse provides a unified environment for accessing, discove -This guide shows you how to use Amazon SageMaker Lakehouse with integrated access controls for Athena federated queries. In this guide, you create an environment where data analysts can discover and query data across sources while administrators maintain consistent governance and appropriate security controls. This guide includes the following steps: +This guide shows you how to use SageMaker Lakehouse with integrated access controls for Athena federated queries. In this guide, you create an environment where data analysts can discover and query data across sources while administrators maintain consistent governance and appropriate security controls. This guide includes the following steps: @@ -41 +41 @@ This guide shows you how to use Amazon SageMaker Lakehouse with integrated acces - 1. Set up federated connections between Amazon SageMaker Lakehouse and DynamoDB. + 1. Set up federated connections between SageMaker Lakehouse and DynamoDB. @@ -43 +43 @@ This guide shows you how to use Amazon SageMaker Lakehouse with integrated acces - * Create connections that serve as bridges between your Amazon SageMaker Lakehouse and external data sources. + * Create connections that serve as bridges between your SageMaker Lakehouse and external data sources. @@ -53 +53 @@ This guide shows you how to use Amazon SageMaker Lakehouse with integrated acces - * Access data from the connected data source within your Amazon SageMaker Lakehouse environment. + * Access data from the connected data source within your SageMaker Lakehouse environment. @@ -119 +119 @@ For more information about how to create a project in SageMaker Unified Studio, - * Administrator access to a data source. Amazon SageMaker Lakehouse connections support [several popular data sources](https://docs.aws.amazon.com/sagemaker-unified-studio/latest/userguide/lakehouse-data-connection.html#lakehouse-data-connection-supported), such as Amazon DynamoDB, PostgreSQL, and [Amazon DocumentDB](https://aws.amazon.com/documentdb/). In this guide, we use DynamoDB as the data source. + * Administrator access to a data source. SageMaker Lakehouse connections support [several popular data sources](https://docs.aws.amazon.com/sagemaker-unified-studio/latest/userguide/lakehouse-data-connection.html#lakehouse-data-connection-supported), such as Amazon DynamoDB, PostgreSQL, and [Amazon DocumentDB](https://aws.amazon.com/documentdb/). In this guide, we use DynamoDB as the data source. @@ -170 +170,6 @@ For more information about setting up a DynamoDB data source by using AWS CloudS - "Principal": "*", + "Principal": { + "AWS": [ + "arn:aws:iam::AWS_account_ID:role/datazone_usr_role_xxxxxxxxxxxxxx_yyyyyyyyyyyyyy", + "arn:aws:iam::AWS_account_ID:role/datazone_usr_role_zzzzzzzzzzzzzz_aaaaaaaaaaaaaa" + ] + }, @@ -178,9 +183 @@ For more information about setting up a DynamoDB data source by using AWS CloudS - "Resource": "arn:aws:dynamodb:AWS_Region:AWS_account_ID:table/dynamodb_table", - "Condition": { - "ArnEquals": { - "aws:PrincipalArn": [ - "arn:aws:iam::AWS_account_ID:role/datazone_usr_role_xxxxxxxxxxxxxx_yyyyyyyyyyyyyy", - "arn:aws:iam::AWS_account_ID:role/datazone_usr_role_zzzzzzzzzzzzzz_aaaaaaaaaaaaaa" - ] - } - } + "Resource": "arn:aws:dynamodb:AWS_Region:AWS_account_ID:table/customer_ddb" @@ -192 +189 @@ For more information about setting up a DynamoDB data source by using AWS CloudS -This example policy allows connecting to DynamoDB tables as a federated source. Replace `AWS_Region` with your AWS Region, `AWS_account_ID` with the AWS account ID where DynamoDB is deployed, `dynamodb_table` with the DynamoDB table that you intend to query from SageMaker Unified Studio, `datazone_usr_role_xxxxxxxxxxxxxx_yyyyyyyyyyyyyy` with the admin project role, and `datazone_usr_role_zzzzzzzzzzzzzz_aaaaaaaaaaaaaa` with the data analyst project role in SageMaker Unified Studio. For more information about how to attach a policy to a DynamoDB data source, see [Attach a policy to a DynamoDB existing table](https://docs.aws.amazon.com/amazondynamodb/latest/developerguide/rbac-attach-resource-based-policy.html) in the _Amazon DynamoDB Developer Guide_. +This example policy allows connecting to DynamoDB tables as a federated source. Replace `AWS_Region` with your AWS Region, `AWS_account_ID` with the AWS account ID where DynamoDB is deployed, `customer_ddb` with the DynamoDB table that you intend to query from SageMaker Unified Studio, `datazone_usr_role_xxxxxxxxxxxxxx_yyyyyyyyyyyyyy` with the admin project role, and `datazone_usr_role_zzzzzzzzzzzzzz_aaaaaaaaaaaaaa` with the data analyst project role in SageMaker Unified Studio. For more information about how to attach a policy to a DynamoDB data source, see [Attach a policy to a DynamoDB existing table](https://docs.aws.amazon.com/amazondynamodb/latest/developerguide/rbac-attach-resource-based-policy.html) in the _Amazon DynamoDB Developer Guide_. @@ -222 +219 @@ The first step is to set up federated catalogs for our data sources using an adm -SageMaker Unified Studio connects to the DynamoDB data source that you created in the prerequisites, registers the data source as a federated catalog with Amazon SageMaker Lakehouse, and displays it in your data explorer. The catalog references your DynamoDB data source. +SageMaker Unified Studio connects to the DynamoDB data source that you created in the prerequisites, registers the data source as a federated catalog with SageMaker Lakehouse, and displays it in your data explorer. The catalog references your DynamoDB data source. @@ -230 +227 @@ SageMaker Unified Studio connects to the DynamoDB data source that you created i - 3. Choose the Amazon SageMaker Lakehouse catalog that you just created to view its contents. Use the data explorer to drill down to a table and choose **Query with Athena**. + 3. Choose the SageMaker Lakehouse catalog that you just created to view its contents. Use the data explorer to drill down to a table and choose **Query with Athena**. @@ -246 +243 @@ Access to the data source in the SageMaker Unified Studio project is governed by -For more information about creating connections in Amazon SageMaker Lakehouse, see [Creating a connection in Amazon SageMaker Lakehouse](https://docs.aws.amazon.com/sagemaker-unified-studio/latest/userguide/lakehouse-create-connection.html) in the _Amazon SageMaker Unified Studio User Guide_. For more information about creating catalogs, see [Creating a catalog](https://docs.aws.amazon.com/sagemaker-unified- studio/latest/userguide/lakehouse-create-catalog.html) in the _Amazon SageMaker Unified Studio User Guide_. +For more information about creating connections in SageMaker Lakehouse, see [Creating a connection in SageMaker Lakehouse](https://docs.aws.amazon.com/sagemaker-unified-studio/latest/userguide/lakehouse-create-connection.html) in the _Amazon SageMaker Unified Studio User Guide_. For more information about creating catalogs, see [Creating a catalog](https://docs.aws.amazon.com/sagemaker-unified-studio/latest/userguide/lakehouse-create-catalog.html) in the _Amazon SageMaker Unified Studio User Guide_. @@ -250 +247 @@ For more information about creating connections in Amazon SageMaker Lakehouse, s -Security is a critical aspect of data access. Amazon SageMaker Lakehouse provides integrated access controls that work with federated queries in Athena to ensure proper governance. You can manage permissions at the catalog, database, and table levels. Administrators can apply access controls at different levels of granularity to ensure sensitive data remains protected while expanding data access. +Security is a critical aspect of data access. SageMaker Lakehouse provides integrated access controls that work with federated queries in Athena to ensure proper governance. You can manage permissions at the catalog, database, and table levels. Administrators can apply access controls at different levels of granularity to ensure sensitive data remains protected while expanding data access. @@ -260 +257 @@ This step is to delegate access permissions on your DynamoDB federated catalogs - 3. Choose the federated catalog name that you set up in Step 1. You'll see the databases. + 3. Choose the federated catalog name that you set up in Step 1: Set up federated catalogs. You'll see the databases. @@ -326 +323 @@ For example, if you wish to restrict access to a sensitive column containing the -In this example, we demonstrate how to set up a basic column-level filter to restrict access to sensitive data. However, Amazon SageMaker Lakehouse supports a broad range of fine-grained access control scenarios beyond column filters that allow you to meet complex security and compliance requirements across diverse data sources. For more information about managing permissions on catalogs, see [Adding existing databases and catalogs using AWS Lake Formation permissions](https://docs.aws.amazon.com/sagemaker-unified-studio/latest/userguide/lakehouse-add-catalog.html) in the _Amazon SageMaker Unified Studio User Guide_ and [Managing Lake Formation Permissions](https://docs.aws.amazon.com/lake-formation/latest/dg/managing-permissions.html) in the _AWS Lake Formation Developer Guide_. +In this example, we demonstrate how to set up a basic column-level filter to restrict access to sensitive data. However, SageMaker Lakehouse supports a broad range of fine-grained access control scenarios beyond column filters that allow you to meet complex security and compliance requirements across diverse data sources. For more information about managing permissions on catalogs, see [Adding existing databases and catalogs using AWS Lake Formation permissions](https://docs.aws.amazon.com/sagemaker-unified-studio/latest/userguide/lakehouse-add-catalog.html) in the _Amazon SageMaker Unified Studio User Guide_ and [Managing Lake Formation Permissions](https://docs.aws.amazon.com/lake-formation/latest/dg/managing-permissions.html) in the _AWS Lake Formation Developer Guide_. @@ -369 +366 @@ Note how permissions are working as expected because the query result doesn't in -Make sure you remove the Amazon SageMaker Lakehouse resources to mitigate any unexpected costs. Delete the following resources: +Make sure you remove the SageMaker Lakehouse resources to mitigate any unexpected costs. Delete the following resources: @@ -373 +370 @@ Make sure you remove the Amazon SageMaker Lakehouse resources to mitigate any un -Specifically, choose your project from SageMaker Unified Studio. Choose **Data** in the navigation pane. Choose the Amazon SageMaker Lakehouse catalog that you created in Step 1. Choose the **Actions** menu and choose **Remove**. Type "**Confirm** " and choose **Remove connection**. +Specifically, choose your project from SageMaker Unified Studio. Choose **Data** in the navigation pane. Choose the SageMaker Lakehouse catalog that you created in Step 1. Choose the **Actions** menu and choose **Remove**. Type "**Confirm** " and choose **Remove connection**. @@ -386 +383 @@ Specifically, choose your project from SageMaker Unified Studio. Choose **Data** -Now that you've successfully set up Amazon SageMaker Lakehouse integrated access controls for Athena federated queries, consider these next steps to further enhance your data governance and analytics capabilities: +Now that you've successfully set up SageMaker Lakehouse integrated access controls for Athena federated queries, consider these next steps to further enhance your data governance and analytics capabilities: @@ -401 +398 @@ Now that you've successfully set up Amazon SageMaker Lakehouse integrated access -This integration between Amazon SageMaker Lakehouse and Athena federated queries provides significant benefits for organizations with diverse data ecosystems. Data scientists can now analyze customer behavior by combining transaction data from PostgreSQL with clickstream data in [Amazon S3](https://aws.amazon.com/s3/). Financial analysts can query historical market data alongside real-time trading information without complex ETL processes. Healthcare researchers can analyze patient records stored in different systems while maintaining compliance with privacy regulations. +This integration between SageMaker Lakehouse and Athena federated queries provides significant benefits for organizations with diverse data ecosystems. Data scientists can now analyze customer behavior by combining transaction data from PostgreSQL with clickstream data in [Amazon S3](https://aws.amazon.com/s3/). Financial analysts can query historical market data alongside real-time trading information without complex ETL processes. Healthcare researchers can analyze patient records stored in different systems while maintaining compliance with privacy regulations. @@ -403 +400 @@ This integration between Amazon SageMaker Lakehouse and Athena federated queries -For more information about federated queries in Athena and the data sources that support fine-grained access controls, see [Register your connection as a Glue Data Catalog](https://docs.aws.amazon.com/athena/latest/ug/register-connection-as-gdc.html) in the _Athena User Guide_. For more information about extending your Amazon SageMaker Lakehouse environment, see [Add Data to Amazon SageMaker Lakehouse](https://docs.aws.amazon.com/sagemaker-unified-studio/latest/userguide/lakehouse-add-data.html) and [Publishing Data](https://docs.aws.amazon.com/sagemaker-unified-studio/latest/userguide/lakehouse-publish.html) in the _Amazon SageMaker Unified Studio User Guide_. For more information about specific use cases and implementation examples, see [Simplify data access for your enterprise using Amazon SageMaker Lakehouse](https://aws.amazon.com/blogs/big-data/simplify-data-access-for-your-enterprise-using-amazon-sagemaker-lakehouse/), [Simplify analytics and AI/ML with new Amazon SageMaker Lakehouse](https://aws.amazon.com/blogs/aws/simplify-analytics-and-aiml-with-new-amazon-sagemaker-lakehouse/), and [Catalog and govern Amazon Athena federated queries with Amazon SageMaker Lakehouse](https://aws.amazon.com/blogs/big-data/catalog-and-govern-amazon-athena-federated-queries-with-amazon-sagemaker-lakehouse/) in the _AWS Blog posts_. +For more information about federated queries in Athena and the data sources that support fine-grained access controls, see [Register your connection as a Glue Data Catalog](https://docs.aws.amazon.com/athena/latest/ug/register-connection-as-gdc.html) in the _Athena User Guide_. For more information about extending your SageMaker Lakehouse environment, see [Add Data to SageMaker Lakehouse](https://docs.aws.amazon.com/sagemaker-unified-studio/latest/userguide/lakehouse-add-data.html) and [Publishing Data](https://docs.aws.amazon.com/sagemaker-unified-studio/latest/userguide/lakehouse-publish.html) in the _Amazon SageMaker Unified Studio User Guide_. For more information about specific use cases and implementation examples, see [Simplify data access for your enterprise using SageMaker Lakehouse](https://aws.amazon.com/blogs/big-data/simplify-data-access-for-your-enterprise-using-amazon-sagemaker-lakehouse/), [Simplify analytics and AI/ML with new SageMaker Lakehouse](https://aws.amazon.com/blogs/aws/simplify-analytics-and-aiml-with-new-amazon-sagemaker-lakehouse/), and [Catalog and govern Amazon Athena federated queries with SageMaker Lakehouse](https://aws.amazon.com/blogs/big-data/catalog-and-govern-amazon-athena-federated-queries-with-amazon-sagemaker-lakehouse/) in the _AWS Blog posts_.