AWS sagemaker-unified-studio documentation change
Summary
Added new 'Update Root Domain Unit Owner' section detailing IAM permissions and ownership transfer requirements
Security assessment
Documents security-critical procedure for ownership transfer including required IAM permissions (datazone:UpdateRootDomainUnitOwner), which impacts access control management
Diff
diff --git a/sagemaker-unified-studio/latest/adminguide/user-management.md b/sagemaker-unified-studio/latest/adminguide/user-management.md index 03cddb942..28cc46e75 100644 --- a//sagemaker-unified-studio/latest/adminguide/user-management.md +++ b//sagemaker-unified-studio/latest/adminguide/user-management.md @@ -4,0 +5,2 @@ +Update Root Domain Unit Owner + @@ -67,0 +70,26 @@ You can add new owners, by expanding **Add** and choosing the add SSO users and +## Update Root Domain Unit Owner + +The root domain unit owner for your Amazon SageMaker domain can be changed using AWS CLI or API. This procedure is helpful when the original IAM role/user no longer exists and ownership needs to be replaced. + +To use the AWS CLI to update the root domain unit owner, use the update-root-domain-unit-owner command. The IAM user or role initiating the call needs to have the datazone:UpdateRootDomainUnitOwner permission. + +Considerations: + + 1. Domain ID, Current Owner, and New Owner are required. + + 2. The new owner needs to exist as a user in the domain. + + 3. SSO users/groups are referenced using their display name. IAM users/groups are referenced using their ARN. + + + + +Example command: + + + aws datazone update-root-domain-unit-owner \ + --domain-identifier DOMAIN_ID \ + --current-owner CURRENT_OWNER \ + --new-owner NEW_OWNER + +