AWS::SageMaker::Domain - AWS CloudFormation

AWS::SageMaker::Domain

Creates a Domain used by Amazon SageMaker Studio. A domain consists of an associated Amazon Elastic File System (EFS) volume, a list of authorized users, and a variety of security, application, policy, and Amazon Virtual Private Cloud (VPC) configurations. An AWS account is limited to one domain per region. Users within a domain can share notebook files and other artifacts with each other.

EFS storage

When a domain is created, an EFS volume is created for use by all of the users within the domain. Each user receives a private home directory within the EFS volume for notebooks, Git repositories, and data files.

SageMaker uses the AWS Key Management Service (AWS KMS) to encrypt the EFS volume attached to the domain with an AWS managed customer master key (CMK) by default. For more control, you can specify a customer managed CMK. For more information, see Protect Data at Rest Using Encryption.

VPC configuration

All SageMaker Studio traffic between the domain and the EFS volume is through the specified VPC and subnets. For other Studio traffic, you can specify the AppNetworkAccessType parameter. AppNetworkAccessType corresponds to the network access type that you choose when you onboard to Studio. The following options are available:

  • PublicInternetOnly - Non-EFS traffic goes through a VPC managed by Amazon SageMaker, which allows internet access. This is the default value.

  • VpcOnly - All Studio traffic is through the specified VPC and subnets. Internet access is disabled by default. To allow internet access, you must specify a NAT gateway.

    When internet access is disabled, you won't be able to run a Studio notebook or to train or host models unless your VPC has an interface endpoint to the SageMaker API and runtime or a NAT gateway and your security groups allow outbound connections.

Important

NFS traffic over TCP on port 2049 needs to be allowed in both inbound and outbound rules in order to launch a SageMaker Studio app successfully.

For more information, see Connect SageMaker Studio Notebooks to Resources in a VPC.

Syntax

To declare this entity in your AWS CloudFormation template, use the following syntax:

JSON

{ "Type" : "AWS::SageMaker::Domain", "Properties" : { "AppNetworkAccessType" : String, "AuthMode" : String, "DefaultUserSettings" : UserSettings, "DomainName" : String, "KmsKeyId" : String, "SubnetIds" : [ String, ... ], "Tags" : [ Tag, ... ], "VpcId" : String } }

YAML

Type: AWS::SageMaker::Domain Properties: AppNetworkAccessType: String AuthMode: String DefaultUserSettings: UserSettings DomainName: String KmsKeyId: String SubnetIds: - String Tags: - Tag VpcId: String

Properties

AppNetworkAccessType

Specifies the VPC used for non-EFS traffic. The default value is PublicInternetOnly.

  • PublicInternetOnly - Non-EFS traffic is through a VPC managed by Amazon SageMaker, which allows direct internet access

  • VpcOnly - All Studio traffic is through the specified VPC and subnets

Valid Values: PublicInternetOnly | VpcOnly

Required: No

Type: String

Update requires: Replacement

AuthMode

The mode of authentication that members use to access the domain.

Valid Values: SSO | IAM

Required: Yes

Type: String

Update requires: Replacement

DefaultUserSettings

The default user settings.

Required: Yes

Type: UserSettings

Update requires: No interruption

DomainName

The domain name.

Required: Yes

Type: String

Maximum: 63

Pattern: ^[a-zA-Z0-9](-*[a-zA-Z0-9]){0,62}

Update requires: Replacement

KmsKeyId

SageMaker uses AWS KMS to encrypt the EFS volume attached to the domain with an AWS managed customer master key (CMK) by default. For more control, specify a customer managed CMK.

Length Constraints: Maximum length of 2048.

Pattern: .*

Required: No

Type: String

Update requires: Replacement

SubnetIds

The VPC subnets that Studio uses for communication.

Length Constraints: Maximum length of 32.

Array members: Minimum number of 1 item. Maximum number of 16 items.

Pattern: [-0-9a-zA-Z]+

Required: Yes

Type: List of String

Update requires: Replacement

Tags

Tags to associated with the Domain. Each tag consists of a key and an optional value. Tag keys must be unique per resource. Tags are searchable using the Search API.

Tags that you specify for the Domain are also added to all Apps that are launched in the Domain.

Array members: Minimum number of 0 items. Maximum number of 50 items.

Required: No

Type: List of Tag

Update requires: Replacement

VpcId

The ID of the Amazon Virtual Private Cloud (VPC) that Studio uses for communication.

Length Constraints: Maximum length of 32.

Pattern: [-0-9a-zA-Z]+

Required: Yes

Type: String

Update requires: Replacement

Return values

Ref

When you pass the logical ID of this resource to the intrinsic Ref function, Ref returns the domain ID, such as d-xxxxxxxxxxxx.

For more information about using the Ref function, see Ref.

Fn::GetAtt

The Fn::GetAtt intrinsic function returns a value for a specified attribute of this type. The following are the available attributes and sample return values.

For more information about using the Fn::GetAtt intrinsic function, see Fn::GetAtt.

DomainArn

The Amazon Resource Name (ARN) of the domain, such as arn:aws:sagemaker:us-west-2:account-id:domain/my-domain-name.

DomainId

The domain ID.

HomeEfsFileSystemId

The ID of the Amazon Elastic File System (EFS) managed by this Domain.

SingleSignOnManagedApplicationInstanceId

The AWS SSO managed application instance ID.

Url

The URL for the domain.