Common setup for Amazon SageMaker Unified Studio with TIP on Amazon EMR on EC2

Complete the following setup steps before configuring either Full Table Access (FTA) or Fine-Grained Access Control (FGAC). These steps are shared across both use cases.

Domain prerequisite

Create the Amazon SageMaker Unified Studio domain through the console Quick setup option with AWS IAM Identity Center (IAM Identity Center) enabled. Quick setup provisions the domain Amazon S3 bucket that trusted identity propagation and the Amazon EMR on EC2 blueprint require.

Note

Amazon SageMaker Unified Studio integration with Amazon EMR on EC2 through trusted identity propagation requires Amazon EMR release 7.8.0 or later.

You need the following:

• A Amazon SageMaker Unified Studio domain. For instructions to create a Amazon SageMaker Unified Studio domain, refer to the quick setup guide in the Amazon SageMaker Unified Studio documentation.

  1. The domain should be enabled with trusted identity propagation, following the instructions in Trusted identity propagation.

  2. The domain's project profile should be enabled with Amazon EMR on EC2. You can choose either General purpose or Memory-Optimized profile. You will need to provide a value for certificateLocation. For detailed instructions, refer to Specify PEM certificate for EmrOnEc2 blueprint. You can use OpenSSL to generate a self-signed X.509 certificate with a 2048-bit RSA private key. Detailed instructions for creating one are at Create keys and certificates for data encryption with Amazon EMR.

For a detailed walkthrough of this setup, see the blog post Use trusted identity propagation for Apache Spark interactive sessions in Amazon SageMaker Unified Studio.

Step 1: Set up IAM Identity Center and sync users

Create an IAM Identity Center instance and provision users. For detailed instructions, see Creating an Identity Center instance and syncing users.

Step 2: Set up Lake Formation

Configure Lake Formation with IAM Identity Center integration and register your data locations. For detailed instructions, see Set up Lake Formation.

Additionally, configure the Lake Formation location registration role as described in the "1. AWS Lake Formation setup to configure the roles" section. To use AWS Lake Formation with Amazon EMR, create a custom role to register Amazon Simple Storage Service locations for your data source. You need to create a new custom role with Amazon S3 access. Do not use the default role, which is explained in more detail at Setting up AWS Lake Formation with IAM Identity Center.

Use the following custom trust policy for the Lake Formation location registration role:

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Principal": {
                "Service": [
                    "lakeformation.amazonaws.com"
                ]
            },
            "Action": "sts:AssumeRole"
        }
    ]
}

• If you don't already have a test data source location in Amazon S3, go to the Amazon S3 console and create a new bucket. For example, you can name it s3://tip-blog-s3-lf- followed by your AWS account ID.

• Navigate to the AWS Identity and Access Management console and create an IAM role for Lake Formation location registration, for example LFRole-data-access-permissions-check. To create an IAM role:

  1. Go to Roles → Create role

  2. Select Custom trust policy and paste the following trust relationship:

     {
         "Version": "2012-10-17",
         "Statement": [
             {
                 "Effect": "Allow",
                 "Principal": {
                     "Service": [
                         "lakeformation.amazonaws.com"
                     ]
                 },
                 "Action": "sts:AssumeRole"
             }
         ]
     }

  3. Attach below policies to your newly created role:

     • The following custom Amazon S3 policy (Replace the demo bucket names with your Amazon S3 bucket names that contain underlying data, for example s3://tip-blog-s3-lf-<your_account_id>/):

       {
           "Version": "2012-10-17",
           "Statement": [
               {
                   "Effect": "Allow",
                   "Action": [
                       "s3:PutObject",
                       "s3:GetObject",
                       "s3:DeleteObject",
                       "s3:ListBucket"
                   ],
                   "Resource": [
                       "arn:aws:s3:::amzn-s3-demo-bucket1",
                       "arn:aws:s3:::amzn-s3-demo-bucket2/*"
                   ]
               }
           ]
       }

  4. Open the AWS Lake Formation console.

     • From the left menu open Data lake locations under Administration section then Register location.

       

       Register location.

     • Browse the Amazon S3 path you have created

     • Attach IAM role created above LFRole-data-access-permissions-check that has read/write access to the chosen Amazon S3 path.

     • Choose Lake Formation for Permission mode and click on Register location.

       

       Register a data lake location.

Step 3: Enable Trusted Identity Propagation in Amazon SageMaker Unified Studio

Enable enableTrustedIdentityPropagationPermissions in the Tooling blueprint parameters for your Amazon SageMaker Unified Studio domain. For detailed instructions, see Trusted identity propagation in the Amazon SageMaker Unified Studio Administrator Guide.

1. Navigate to the SageMaker AI management console (this is the SageMaker AI console, not the Amazon SageMaker Unified Studio console) and choose the appropriate AWS Region.

2. Choose the domain that contains the project profile you want to update.

3. Choose the Project profiles tab and then choose the project profile (for example, All capabilities).

4. Choose Edit.

5. In the Tooling blueprint parameters section, choose the enableTrustedIdentityPropagationPermissions parameter and choose Edit.

6. Set the parameter value to True.

7. Choose Save.

Step 4: Grant Lake Formation permissions to the IAM Identity Center user

Grant Lake Formation permissions on the database and table to the IAM Identity Center user who will log in to Amazon SageMaker Unified Studio.

1. Open the Lake Formation console and choose Data permissions under Permissions.

2. Choose Grant.

3. Under Principals, choose IAM Identity Center users and groups and select your IAM Identity Center user.

4. Under Named Data Catalog resources, select your database. Under Database permissions, select Create table and Describe. Choose Grant.

5. Grant again, this time selecting the table. Under Table permissions, select Select and Describe. Choose Grant.

Step 5: Create a project in Amazon SageMaker Unified Studio

1. Sign in to the Amazon SageMaker Unified Studio domain with your IAM Identity Center user credentials.

2. Create a new project using the blueprint (for example, All capabilities) for which enableTrustedIdentityPropagationPermissions is set to true.

3. Verify data access: as a project user, check the Data section to confirm you can see the database and table using the preview feature.