AWS sagemaker documentation change

Service: sagemaker · 2026-05-10 · Documentation low

File: sagemaker/latest/dg/execution-roles-and-spaces.md

Summary

Added documentation for Execution Role Session Name Mode feature, including configuration options and CLI examples

Security assessment

This change documents a new configuration option (ExecutionRoleSessionNameMode) that improves auditability by allowing user-specific session names in CloudWatch and CloudTrail logs. While it enhances security posture through better traceability, there's no evidence it addresses a specific security vulnerability.

Diff

diff --git a/sagemaker/latest/dg/execution-roles-and-spaces.md b/sagemaker/latest/dg/execution-roles-and-spaces.md
index 02901d84c..41a397d72 100644
--- a//sagemaker/latest/dg/execution-roles-and-spaces.md
+++ b//sagemaker/latest/dg/execution-roles-and-spaces.md
@@ -7 +7 @@
-SageMaker AI execution rolesExample of flexible permissions with execution roles
+SageMaker AI execution rolesExample of flexible permissions with execution rolesExecution role session name mode
@@ -64,0 +65,2 @@ For information on modifying your execution role, see [Modify permissions to exe
+  * Execution role session name mode
+
@@ -94,0 +97,35 @@ For information on SageMaker AI execution roles and adding additional permission
+## Execution role session name mode
+
+You can configure the execution role session name mode for your domain using the `ExecutionRoleSessionNameMode` field in [StudioWebPortalSettings](https://docs.aws.amazon.com/sagemaker/latest/APIReference/API_StudioWebPortalSettings.html). The session name mode determines the session name of the execution role when users access the Studio web portal.
+
+You can set this value at the domain level as a default for all users, or override it at the user profile level for individual users.
+
+The following values are available:
+
+USER_IDENTITY
+    
+
+The session name of the execution role corresponds to the user's identity. For IAM domains, the session name is the IAM session name used to generate the presigned URL. For IAM Identity Center domains, the session name is the username of the associated IAM Identity Center user.
+
+STATIC
+    
+
+The session name defaults to `SageMaker`. This is also the default behavior if `ExecutionRoleSessionNameMode` is not set.
+
+Setting the execution role session name mode to `USER_IDENTITY` enables you to identify which user performed actions using the execution role in Amazon CloudWatch logs and AWS CloudTrail events.
+
+The following example shows how to set the execution role session name mode to `USER_IDENTITY` for a domain.
+    
+    
+    aws sagemaker update-domain \
+      --domain-id domainId \
+      --default-user-settings '{"StudioWebPortalSettings": {"ExecutionRoleSessionNameMode": "USER_IDENTITY"}}'
+
+The following example shows how to set the execution role session name mode for a specific user profile.
+    
+    
+    aws sagemaker update-user-profile \
+      --domain-id domainId \
+      --user-profile-name userProfileName \
+      --user-settings '{"StudioWebPortalSettings": {"ExecutionRoleSessionNameMode": "USER_IDENTITY"}}'
+