AWS cli medium security documentation change

Service: cli · 2025-08-13 · Security-related medium

File: cli/latest/reference/sagemaker/create-domain.md

Summary

Added TrustedIdentityPropagationSettings configuration for SageMaker domains

Security assessment

Introduces documentation for Trusted Identity Propagation (TIP) settings that control IAM Identity Center user identity propagation to TIP-enabled services. This directly relates to access control and identity management security features.

Diff

diff --git a/cli/latest/reference/sagemaker/create-domain.md b/cli/latest/reference/sagemaker/create-domain.md
index f9b1bae83..3b41ce576 100644
--- a//cli/latest/reference/sagemaker/create-domain.md
+++ b//cli/latest/reference/sagemaker/create-domain.md
@@ -15 +15 @@
-  * [AWS CLI 2.28.6 Command Reference](../../index.html) »
+  * [AWS CLI 2.28.8 Command Reference](../../index.html) »
@@ -1154,0 +1155,17 @@ JSON Syntax:
+> 
+> TrustedIdentityPropagationSettings -> (structure)
+>
+>> The Trusted Identity Propagation (TIP) settings for the SageMaker domain. These settings determine how user identities from IAM Identity Center are propagated through the domain to TIP enabled Amazon Web Services services.
+>> 
+>> Status -> (string)
+>>
+>>> The status of Trusted Identity Propagation (TIP) at the SageMaker domain level.
+>>> 
+>>> When disabled, standard IAM role-based access is used.
+>>> 
+>>> When enabled:
+>>> 
+>>>   * User identities from IAM Identity Center are propagated through the application to TIP enabled Amazon Web Services services.
+>>>   * New applications or existing applications that are automatically patched, will use the domain level configuration.
+>>> 
+
@@ -1231 +1248 @@ Shorthand Syntax:
-    SecurityGroupIds=string,string,RStudioServerProDomainSettings={DomainExecutionRoleArn=string,RStudioConnectUrl=string,RStudioPackageManagerUrl=string,DefaultResourceSpec={SageMakerImageArn=string,SageMakerImageVersionArn=string,SageMakerImageVersionAlias=string,InstanceType=string,LifecycleConfigArn=string}},ExecutionRoleIdentityConfig=string,DockerSettings={EnableDockerAccess=string,VpcOnlyTrustedAccounts=[string,string]},AmazonQSettings={Status=string,QProfileArn=string},UnifiedStudioSettings={StudioWebPortalAccess=string,DomainAccountId=string,DomainRegion=string,DomainId=string,ProjectId=string,EnvironmentId=string,ProjectS3Path=string,SingleSignOnApplicationArn=string}
+    SecurityGroupIds=string,string,RStudioServerProDomainSettings={DomainExecutionRoleArn=string,RStudioConnectUrl=string,RStudioPackageManagerUrl=string,DefaultResourceSpec={SageMakerImageArn=string,SageMakerImageVersionArn=string,SageMakerImageVersionAlias=string,InstanceType=string,LifecycleConfigArn=string}},ExecutionRoleIdentityConfig=string,TrustedIdentityPropagationSettings={Status=string},DockerSettings={EnableDockerAccess=string,VpcOnlyTrustedAccounts=[string,string]},AmazonQSettings={Status=string,QProfileArn=string},UnifiedStudioSettings={StudioWebPortalAccess=string,DomainAccountId=string,DomainRegion=string,DomainId=string,ProjectId=string,EnvironmentId=string,ProjectS3Path=string,SingleSignOnApplicationArn=string}
@@ -1251,0 +1269,3 @@ JSON Syntax:
+      "TrustedIdentityPropagationSettings": {
+        "Status": "ENABLED"|"DISABLED"
+      },
@@ -1949 +1969 @@ Url -> (string)
-  * [AWS CLI 2.28.6 Command Reference](../../index.html) »
+  * [AWS CLI 2.28.8 Command Reference](../../index.html) »