AWS sagemaker-unified-studio medium security documentation change
Summary
Updated documentation for creating custom project profiles, including blueprint selection, account/region configuration options, authorization settings, and step renumbering
Security assessment
Added explicit guidance about account/region restrictions (including account pools) and authorization controls for project creation. The documentation now emphasizes security isolation limitations and provides mechanisms to control cross-account access through account pools and authorization settings.
Diff
diff --git a/sagemaker-unified-studio/latest/adminguide/custom.md b/sagemaker-unified-studio/latest/adminguide/custom.md index 30d48dd6a..4bf2da05a 100644 --- a//sagemaker-unified-studio/latest/adminguide/custom.md +++ b//sagemaker-unified-studio/latest/adminguide/custom.md @@ -7 +7 @@ -Complete the following procedure to create a customr project profile for your Amazon SageMaker unified domain. With the Custom creation option, you can create a project profile from scratch with your own profile settings and a selection of blueprints. +Complete the following procedure to create a custom project profile for your Amazon SageMaker unified domain. With the Custom creation option, you can create a project profile from scratch with your own profile settings and a selection of blueprints. @@ -19 +19 @@ Complete the following procedure to create a customr project profile for your Am - 6. On the **Create project profile** page, in the **Default tooling blueprint deployment settings** section, review the selections for the default deployment settings for the Tooling blueprint and update them as needed. + 6. On the **Create project profile** page, in **Blueprints** , specify the Amazon SageMaker Unified Studio blueprints to use in your project. You can customize each blueprint configuration after this custom project profile is created. @@ -21 +21 @@ Complete the following procedure to create a customr project profile for your Am -###### Important + 7. To configure the project account and Region information you want the profile to use, you can either provide account and Region information that projects will use each time, or you can configure your project profile to allow specifying accounts during project creation. Under **Account and region** , choose one of the following. @@ -23 +23 @@ Complete the following procedure to create a customr project profile for your Am -Note that by creating this project profile from a template, you can either enable the Tooling blueprint in the same AWS account and region as your domain (prepopulated by default) or you can enable the Tooling blueprint in a different AWS account and region from this domain (an associated account). + * To create a project profile that will use the same account and region for each project created, select **Choose account and region**. Projects created with this profile will use the specified account and region and cannot specify otherwise at project creation. @@ -25 +25 @@ Note that by creating this project profile from a template, you can either enabl - 7. On the **Create project profile** page, in the **Additional blueprint deployment settings** section, specify the Amazon SageMaker Unified Studio blueprints to use in your project. You can customize each blueprint configuration after this custom project profile is created. + * To create a project profile that will choose from accounts available at project creation, select **Choose account and region during project creation**. @@ -27 +27 @@ Note that by creating this project profile from a template, you can either enabl -###### Important + * Under **Accounts available during project creation** , you can choose to create a project profile that will provide a list of all AWS accounts associated to the domain for selection at project creation. To choose this option, choose **All associated accounts**. For more information about associated accounts in Amazon SageMaker Unified Studio, see [Associated accounts in Amazon SageMaker Unified Studio](./associated-accounts.html). @@ -29 +29 @@ Note that by creating this project profile from a template, you can either enabl -Note that by creating this project profile from a template, you can either enable these additional blueprints in the same AWS account and region as your domain (prepopulated by default) or you can enable the Tooling blueprint in a different AWS account and region from this domain (an associated account). + * Under **Accounts available during project creation** , you can choose to create a project profile that will provide account pools to be selected at project creation. An account pool is a list of authorized associated accounts and regions. To choose this option, select **Choose account pool(s)**. Next, under **Account pools** , choose the account pool or pools that you want to be available for the project profile to use at project creation. For information about creating and updating account pools, see [Account pools in Amazon SageMaker Unified Studio](./account-pools.html). @@ -31 +31,3 @@ Note that by creating this project profile from a template, you can either enabl - 8. On the **Create project profile** page, in the **Authorization - optional** section, specify who can use this project profile to create projects in all domain units. This can also be done per domain unit in Amazon SageMaker Unified Studio. You can specify **Selected users and groups** or **Allow all users and groups** options. + 8. On the **Create project profile** page, in the **Default tooling blueprint deployment settings** section, review the selections for the default deployment settings for the Tooling blueprint and update them as needed. + + 9. On the **Create project profile** page, in the **Authorization - optional** section, specify who can use this project profile to create projects in all domain units. This can also be done per domain unit in Amazon SageMaker Unified Studio. You can specify **Selected users and groups** or **Allow all users and groups** options. @@ -37 +39 @@ Projects do not provide strong security isolation. To limit cross-domain and cro - 9. On the **Create project profile** page, in the **Project profile readiness** section, specify whether you want to enable this project profile on creation. Unless you check the **Enable project profile on creation** checkbox, your project profile is disabled and not available to use for Amazon SageMaker Unified Studio projects after its creation. Leaving a project profile in a disabled state upon creation gives you the opportunity to customize your blueprints before making the project profile available. + 10. On the **Create project profile** page, in the **Project profile readiness** section, specify whether you want to enable this project profile on creation. Unless you check the **Enable project profile on creation** checkbox, your project profile is disabled and not available to use for Amazon SageMaker Unified Studio projects after its creation. Leaving a project profile in a disabled state upon creation gives you the opportunity to customize your blueprints before making the project profile available. @@ -39 +41 @@ Projects do not provide strong security isolation. To limit cross-domain and cro - 10. Choose **Create project profile**. + 11. Choose **Create project profile**.