AWS sagemaker-unified-studio documentation change
Summary
Restructured user management documentation to separate sections for enabling IAM Identity Center, SAML, and updating root domain unit owner. Added note about IAM Identity Center multi-Region support and clarified SSO configuration options.
Security assessment
This change improves authentication documentation by clarifying single sign-on options (IAM Identity Center and SAML 2.0 federation). The addition of multi-Region support information enhances security posture by documenting cross-region authentication capabilities. No evidence of addressing a specific security vulnerability.
Diff
diff --git a/sagemaker-unified-studio/latest/adminguide/user-management.md b/sagemaker-unified-studio/latest/adminguide/user-management.md index 19ebc609b..1f6b32846 100644 --- a//sagemaker-unified-studio/latest/adminguide/user-management.md +++ b//sagemaker-unified-studio/latest/adminguide/user-management.md @@ -7 +7 @@ -Update Root Domain Unit Owner +Enable IAM Identity CenterEnable SAMLUpdate Root Domain Unit Owner @@ -11 +11,3 @@ Update Root Domain Unit Owner -By default, Amazon SageMaker unified domains support IAM user credentials. You can also enable access to the Amazon SageMaker unified domains in the Amazon SageMaker Unified Studio for users with SSO and SAML credentials. To do this, complete the following procedures. +By default, Amazon SageMaker unified domains support IAM user credentials. You can also enable single sign-on access to Amazon SageMaker Unified Studio through IAM Identity Center or a direct SAML 2.0 federation. To do this, complete the following procedures. + +## Enable IAM Identity Center @@ -14,0 +17,4 @@ To enable access to the Amazon SageMaker unified domains in the Amazon SageMaker +###### Note + +The Amazon SageMaker Unified Studio domain can reside in a different AWS Region than where the IAM Identity Center organization instance is located using IAM Identity Center multi-Region support. Once IAM Identity Center multi-Region is setup follow the same steps below to enable single sign-on through IAM Identity Center for your domain. To use this feature, your IAM Identity Center instance must be connected to an external identity provider (IdP). For information on setting up IAM Identity Center multi-Region, see [Using IAM Identity Center across multiple AWS Regions](https://docs.aws.amazon.com/singlesignon/latest/userguide/multi-region-iam-identity-center.html). + @@ -39,0 +46,2 @@ You are either connecting to an organization instance of the IAM Identity Center +## Enable SAML + @@ -58,0 +67,2 @@ Complete the following procedure to configure SAML user access to Amazon SageMak +## Update Root Domain Unit Owner + @@ -72,2 +81,0 @@ You can add new owners, by expanding **Add** and choosing the add SSO users and -## Update Root Domain Unit Owner -