AWS sagemaker-unified-studio documentation change
Summary
Added IAM permissions requirements section and expanded export process documentation
Security assessment
Added detailed IAM policy for secure access control and referenced KMS permissions, enhancing documentation of security features. However, no specific vulnerability is addressed - this proactively documents security configuration requirements.
Diff
diff --git a/sagemaker-unified-studio/latest/userguide/export-asset-metadata.md b/sagemaker-unified-studio/latest/userguide/export-asset-metadata.md index 1674dda15..889c5e2a9 100644 --- a//sagemaker-unified-studio/latest/userguide/export-asset-metadata.md +++ b//sagemaker-unified-studio/latest/userguide/export-asset-metadata.md @@ -5 +5 @@ -Start exporting asset metadataAsset table schemaQuerying asset tables +RequirementsStart exporting asset metadataAsset table schemaQuerying asset tables @@ -20,0 +21,37 @@ This capability is available in all AWS Regions where Amazon SageMaker Catalog i +## Requirements + +Before you export asset metadata from Amazon SageMaker Unified Studio, make sure that you meet the following requirements: + +### IAM permissions + +The IAM user or role that runs the export commands must have permissions to configure asset metadata export in Amazon DataZone and to create the Amazon S3 Tables resources used to store the exported metadata. + +The following example IAM policy shows the required permissions: + + + { + "Version": "2012-10-17", + "Statement": [ + { + "Effect": "Allow", + "Action": [ + "datazone:GetDataExportConfiguration", + "datazone:PutDataExportConfiguration" + ], + "Resource": "*" + }, + { + "Effect": "Allow", + "Action": [ + "s3tables:CreateTableBucket", + "s3tables:PutTableBucketPolicy" + ], + "Resource": "arn:aws:s3tables:<REGION>:<ACCOUNT_ID>:bucket/aws-sagemaker-catalog" + } + ] + } + +These permissions allow you to retrieve and update the asset metadata export configuration. They also allow Amazon DataZone to create the Amazon SageMaker Catalog S3 table bucket and apply the required bucket policy on your behalf, enabling DataZone to write the exported metadata. + +For KMS related permission requirements, see [KMS permissions for exporting asset metadata in Amazon SageMaker Unified Studio](https://docs.aws.amazon.com/sagemaker-unified-studio/latest/adminguide/sagemaker-unified-studio-export-asset-metadata-kms-permissions.html). + @@ -23 +60 @@ This capability is available in all AWS Regions where Amazon SageMaker Catalog i -To get started, activate dataset export by invoking the `PutDataExportConfiguration` API action, then access the asset table through S3 Tables or Amazon SageMaker Unified Studio's Data tab within 24 hours. Query using Amazon Athena, Studio notebooks, or connect external BI tools through the S3 Tables Iceberg REST Catalog endpoint. +To get started, activate dataset export by invoking the `PutDataExportConfiguration` API action. In response, the DataZone service creates an S3 table bucket named aws-sagemaker-catalog with an asset_metadata namespace and an empty asset table. It also schedules a daily job to export updated asset data. Within 24 hours, you can access the asset table through the S3 Tables console or the Data tab in Amazon SageMaker Unified Studio. You can query the data using Amazon Athena or Studio notebooks, or connect external BI tools through the S3 Tables Iceberg REST Catalog endpoint. @@ -27,2 +63,0 @@ Asset metadata is exported once a day around midnight local time per AWS region. -For more information, see [KMS permissions for exporting asset metadata in Amazon SageMaker Unified Studio](https://docs.aws.amazon.com/sagemaker-unified-studio/latest/adminguide/sagemaker-unified-studio-export-asset-metadata-kms-permissions.html). - @@ -41 +76 @@ With KMS key encryption configuration: -For more information, see the [API reference documentation](https://docs.aws.amazon.com/datazone/latest/APIReference/Welcome.html). +For more information, see the [API reference documentation](https://docs.aws.amazon.com/datazone/latest/APIReference/API_PutDataExportConfiguration.html).