AWS sagemaker-unified-studio documentation change
Summary
Updated project creation workflow with clearer steps, added support for single sign-on users, expanded member management capabilities, and improved terminology consistency.
Security assessment
Changes focus on usability improvements and process clarification without addressing vulnerabilities. No security advisories, CVE references, or vulnerability mitigations are present. Updates include terminology changes (e.g., 'Member IAM role' to 'Project Members'), added SSO support, and refined UI instructions.
Diff
diff --git a/sagemaker-unified-studio/latest/adminguide/setup-projects-iam-based-domains.md b/sagemaker-unified-studio/latest/adminguide/setup-projects-iam-based-domains.md index 4d016c0bf..6552a38d4 100644 --- a//sagemaker-unified-studio/latest/adminguide/setup-projects-iam-based-domains.md +++ b//sagemaker-unified-studio/latest/adminguide/setup-projects-iam-based-domains.md @@ -7 +7 @@ -Preparing IAM rolesCreate new project from domain administration pagePrepare other IAM roles for other users to self-service setup projects +Preparing IAM rolesCreate a project from the domain administration pagePrepare IAM roles and users for self-service project setup @@ -11 +11 @@ Preparing IAM rolesCreate new project from domain administration pagePrepare oth -To create a project within an IAM-based domain you assign Member IAM role or user and Execution IAM role, configure execution permissions for the execution role, and set up storage options. By default, projects can access resources within the domain's AWS account. You can configure the project execution IAM role to access data and resources across AWS accounts and regions. +To create a project within an IAM-based domain, you assign project members (IAM or single sign-on) and an Execution IAM role, configure execution permissions, and set up storage options. By default, projects can access resources within the domain's AWS account. You can configure the project execution IAM role to access data and resources across AWS accounts and Regions. @@ -15 +15 @@ To create a project within an IAM-based domain you assign Member IAM role or use -**Member IAM role:** +**Project Members** @@ -17 +17 @@ To create a project within an IAM-based domain you assign Member IAM role or use - * [SageMakerStudioUserIAMConsolePolicy](https://docs.aws.amazon.com/sagemaker-unified-studio/latest/adminguide/security-iam-awsmanpol-SageMakerStudioUserIAMConsolePolicy.html) must be attached or have the same permissions added via another policy. + * For IAM role or user project members, [SageMakerStudioUserIAMConsolePolicy](https://docs.aws.amazon.com/sagemaker-unified-studio/latest/adminguide/security-iam-awsmanpol-SageMakerStudioUserIAMConsolePolicy.html) must be attached or have the same permissions added through another policy. @@ -31 +31 @@ To create a project within an IAM-based domain you assign Member IAM role or use -## Create new project from domain administration page +## Create a project from the domain administration page @@ -33 +33 @@ To create a project within an IAM-based domain you assign Member IAM role or use - 1. From the domain administration page, choose Projects in the left navigation pane. + 1. From the domain administration page, choose **Projects** in the left navigation pane. @@ -35 +35 @@ To create a project within an IAM-based domain you assign Member IAM role or use - 2. Choose Create project. This will open up the create project panel. + 2. Choose **Create project**. @@ -37 +37 @@ To create a project within an IAM-based domain you assign Member IAM role or use - 3. Give the project a name and choose Next. + 3. Enter a project name and description, and then choose **Next**. @@ -39 +39 @@ To create a project within an IAM-based domain you assign Member IAM role or use - 4. Select a Member role or user. + 4. For **Execution role** , choose either **Auto-create a new role with permissions** or **Use an existing role**. @@ -41 +41 @@ To create a project within an IAM-based domain you assign Member IAM role or use - 5. Select an Execution role, choose either to Auto-create a new role with permissions or Use an existing role. + 5. For **Storage** , choose either to create a new Amazon S3 bucket or use an existing Amazon S3 bucket, and then choose **Next**. @@ -43 +43 @@ To create a project within an IAM-based domain you assign Member IAM role or use - 6. Choose Create. + 6. Add members to your project. Choose IAM or single sign-on users to add as members. You can assign up to 8 members at a time. You can add more members after the project is created. @@ -45 +45 @@ To create a project within an IAM-based domain you assign Member IAM role or use - 7. You should see a Creating project notification. + 7. For each member, assign a **Designation**. @@ -47 +47 @@ To create a project within an IAM-based domain you assign Member IAM role or use - 8. Once the project is successfully created, you should see an entry in the projects table with the project name. + 8. Choose **Create**. @@ -52 +52 @@ To create a project within an IAM-based domain you assign Member IAM role or use -## Prepare other IAM roles for other users to self-service setup projects +## Prepare IAM roles and users for self-service project setup @@ -54 +54 @@ To create a project within an IAM-based domain you assign Member IAM role or use -You can configure other IAM roles in your account to self-setup their Amazon SageMaker Unified Studio project within your IAM-based domain. You must add additional permissions and policies to the existing IAM roles to allow them to setup their own project using the Member IAM role for login and Execution IAM role for accessing data and resources within the project. This enables users from AWS console to create projects using these roles from AWS Services - Amazon Athena, Amazon S3 Tables, and Amazon Redshift. +You can configure IAM roles and users in your account to set up their own Amazon SageMaker Unified Studio project within your IAM-based domain. You must add permissions and policies to the existing IAM roles and users to allow them to set up their own project using the project member for login and the execution IAM role for accessing data and resources within the project. This configuration enables users to create projects from the AWS Management Console using these roles and users, or from AWS services such as Amazon Athena, Amazon S3 Tables, and Amazon Redshift. @@ -56 +56 @@ You can configure other IAM roles in your account to self-setup their Amazon Sag -**Member IAM role:** +**Project member IAM role and user:**