AWS sagemaker-unified-studio documentation change
Summary
Updated documentation for enabling the Tooling blueprint with enhanced details on prerequisites, role configurations, security settings, and post-enablement steps. Added explanations for Provisioning role, Manage access role, Query execution role, S3 bucket usage, VPC requirements, data encryption options, user role policies, and authorized domain units.
Security assessment
The changes provide expanded documentation about security features including IAM roles (Provisioning, Manage access, Query execution), data encryption configurations, and granular IAM policy controls. While these are security enhancements to documentation, there's no evidence of a specific vulnerability being addressed. The updates clarify security best practices but don't reference any security incident.
Diff
diff --git a/sagemaker-unified-studio/latest/adminguide/enable-tooling-blueprint.md b/sagemaker-unified-studio/latest/adminguide/enable-tooling-blueprint.md index fc245fc98..23b502231 100644 --- a//sagemaker-unified-studio/latest/adminguide/enable-tooling-blueprint.md +++ b//sagemaker-unified-studio/latest/adminguide/enable-tooling-blueprint.md @@ -9 +9,11 @@ -The tooling blueprint creates resources for the project, including IAM user roles, security groups, and Amazon SageMaker unified domains. +Before you can create projects with compute capabilities, you must enable the Tooling blueprint and configure its provisioning settings. The Tooling blueprint provisions IAM roles, security groups, and an Amazon SageMaker unified domain for each project. + +To enable the Tooling blueprint, complete the following steps. + +Before you begin, verify that you have the following: + + * Domain administrator access to the Amazon SageMaker Unified Studio domain + + * An AWS account with permissions to create IAM roles and manage resources + + @@ -11 +20,0 @@ The tooling blueprint creates resources for the project, including IAM user role -You can perform the following procedure to enable the Tooling blueprint. @@ -15 +24 @@ You can perform the following procedure to enable the Tooling blueprint. - 2. Choose **View domains** and choose the domain’s name from the list. The name is a hyperlink. + 2. Choose **View domains** and choose the domain's name from the list. The name is a hyperlink. @@ -21 +30,3 @@ You can perform the following procedure to enable the Tooling blueprint. - * Provisioning role - Amazon SageMaker Unified Studio uses this role to provision and manage resources defined in the selected blueprints in your account. + * **Provisioning role** — Amazon SageMaker Unified Studio uses this role to provision and manage resources defined in the selected blueprints in your account. Amazon SageMaker Unified Studio can auto-create this role or you can provide your own. + + * **Manage access role** — This role grants Amazon SageMaker Unified Studio permissions to publish, grant access, and revoke access to Amazon SageMaker Lakehouse, AWS Glue Data Catalog, and Amazon Redshift data. It also grants Amazon SageMaker Unified Studio permissions to publish and manage subscriptions on Amazon SageMaker Catalog data and AI assets. @@ -23 +34 @@ You can perform the following procedure to enable the Tooling blueprint. - * Manage access role - this role grants Amazon SageMaker Unified Studio permissions to publish, grant access, and revoke access to Amazon SageMaker Lakehouse, AWS Glue Data Catalog and Amazon Redshift data. It also grants Amazon SageMaker Unified Studio to publish and manage subscriptions on Amazon SageMaker Catalog data and AI assets. + * **Query execution role** — This role is used while running a query execution. AWS Lake Formation assumes this role to vend credentials needed by Amazon Athena during query execution. @@ -25 +36 @@ You can perform the following procedure to enable the Tooling blueprint. - * Query execution role - this role is used while running a query execution. AWS LakeFormation assumes this role to vend credentials needed by Amazon Athena during query execution. + * **Amazon S3 bucket for projects** — Amazon SageMaker Unified Studio requires an S3 bucket in your AWS account for storing project artifacts and data. @@ -27 +38 @@ You can perform the following procedure to enable the Tooling blueprint. - * Amazon S3 bucket for projects - Amazon SageMaker Unified Studio requires an S3 bucket for projects in your AWS account. + * **Virtual private cloud (VPC)** — Select a VPC configured for use with Amazon SageMaker Unified Studio. For more information, see [Configure VPC Networking for Amazon SageMaker Unified Studio Domain](./vpc-networking-iam-based-domains.html). @@ -29 +40 @@ You can perform the following procedure to enable the Tooling blueprint. - * Virtual private cloud (VPC) - Select a VPC in which to provision your Amazon SageMaker Unified Studio domain. VPCs tagged with Amazon SageMaker Unified Studio should be correctly configured. + * **Data encryption** — This setting is optional. By default, your data is encrypted with an AWS managed key. To choose a different key, customize your encryption settings. @@ -31 +42 @@ You can perform the following procedure to enable the Tooling blueprint. - * Data encryption - your data is encrypted by default with a key that AWS owns and manages for you. To choose a different key, customize your encryption settings. + * **User role policy** — This is an optional advanced configuration. Amazon SageMaker Unified Studio creates IAM roles for project users to perform data analytics, AI, and ML actions. You can attach your own AWS IAM policies to the role rather than using the default system-managed policy. The IAM policy must include all necessary permissions required for the service to function properly. @@ -33 +44 @@ You can perform the following procedure to enable the Tooling blueprint. - * User role policy - Amazon SageMaker Unified Studio creates IAM roles for project users to perform data analytics, AI, and ML actions. You can attach your own AWS IAM policies to the role rather than using the default system-managed policy. This provides more granular control over permissions but requires knowledge of IAM policy configuration. The IAM policy must include all necessary permissions required for the service to function properly. + * **Authorized domain units** — Domain units where projects can access resources defined by the blueprints. @@ -35 +46 @@ You can perform the following procedure to enable the Tooling blueprint. - * Authorized domain units - domain units where projects can access resources defined by the blueprints. + 5. After you specify all configuration settings, choose **Enable blueprint**. @@ -37 +47,0 @@ You can perform the following procedure to enable the Tooling blueprint. - 5. Once all the configuration settings have been specified, choose **Enable blueprint**. @@ -40,0 +51 @@ You can perform the following procedure to enable the Tooling blueprint. +After you enable the Tooling blueprint, you can create projects that use compute capabilities. To configure blueprint parameters such as idle timeout settings and permissions boundaries, see [Manage Tooling blueprint parameters](./manage-tooling-blueprint.html).