Assign designations

You assign project-level designations when you add members to a project or by editing existing project members. Each member has one designation through direct assignment. Members can also inherit designations through group membership. If you directly assign one designation to a user who also belongs to a group with a different designation, the user receives the union of both permission sets.

Important

Admin project membership takes precedence over project designations. If a user is a member of the admin-project-accountID, those permissions override the designation that is assigned to them in another project. For example, a user who belongs to the admin project but has a read-only designation in a separate project can still perform privileged actions in that project, such as deleting project members.

To assign designations from the Amazon SageMaker Unified Studio portal (Identity Center-based domains)

1. Navigate to the project in the Amazon SageMaker Unified Studio portal.

2. Choose the Members tab.

3. To add members, choose Add members.

4. Select the member.

5. Select the designation for the member.

6. Choose Add members.

7. To update an existing member, select a designation from the Designation column for that user.

To assign designations from the domain management portal

You can assign designations from the domain management portal for both IAM and Identity Center-based domains.

1. Sign in to the Amazon SageMaker Unified Studio domain management portal.

2. In the navigation pane, choose Projects.

3. Select the project.

4. Choose the Members tab.

5. To update an existing member, select a designation from the Project designation column for that user.

6. To add members, choose Add members.

7. Select the Type and Member.

To assign a designation (AWS CLI)

To assign a designation using the AWS CLI, run the create-project-membership command.

The --designation field accepts one of the following values: PROJECT_OWNER, PROJECT_CONTRIBUTOR, or USER_CREATED_DESIGNATION. When you specify USER_CREATED_DESIGNATION, you must also specify the --user-created-designation-id parameter, which is the ID of the custom designation to assign.

aws datazone create-project-membership \
    --domain-identifier "dzd_example1234" \
    --project-identifier "proj_example5678" \
    --member '{"userIdentifier": "u-abc123def456"}' \
    --designation "USER_CREATED_DESIGNATION" \
    --user-created-designation-id "123456789"