View a markdown version of this page

Approve and manage access - Amazon SageMaker Unified Studio
Review subscription requestsApprove a requestReject a requestGrant access directlyView and manage existing grantsRevoke access

Approve and manage access

Project members discover tables through catalog search and request access to the ones they need. As an administrator, you review these requests from the Subscriptions page in the admin portal and decide whether to approve or reject them. You can also proactively grant access to specific projects or IAM roles without waiting for a request.

Subscriptions control which IAM roles can query a given asset's underlying data. When a project member requests access to an asset, the system submits a subscription request on behalf of the project's execution role (the IAM role that the project uses to run queries and access data in Lake Formation). When you approve the request, a grant is created in Lake Formation for that execution role.

Note

All projects that share the same execution role gain access because the grant is created for the underlying IAM role of the project.

You can also grant access by creating a subscription directly for a project or for a specific IAM role, without waiting for someone to submit a request.

All subscription management happens on the Subscriptions page in the admin portal. The page has two tabs:

  • The Requests tab shows incoming subscription requests. Each request identifies the person who submitted it and the execution role that will receive the Lake Formation grant.

  • The Grants tab shows all active grants across the domain. The Granted to column shows either a project name or an IAM role ARN, depending on how the grant was created.

Review subscription requests

When a project member requests access to an asset, the request appears on the Requests tab with a Pending status. The Requested by column shows the user who requested access. This can be a single sign-on user in IAM Identity Center or an IAM user or role.

Note

The user or role that requests access is not necessarily getting the access. The access is granted to the project's execution role which may be different than the user or role requesting access.

Admin portal Subscriptions page showing the Requests tab with pending subscription requests

Use the Status filter to show requests by state: Pending, Approved, or Rejected.

Approve a request

To approve a subscription request

  1. Navigate to Amazon SageMaker Unified Studio and choose Domain management to open the admin portal.

  2. In the left navigation pane under Catalog, choose Subscriptions.

  3. On the Requests tab, find the request you want to review.

  4. In the Actions column, choose Actions, then choose View request.

  5. In the Review subscription request panel, review the request details (Requested for, Requested by, Reason for access, Request date) and the Access will be granted to section showing the IAM execution role ARN.

  6. Under Decision details, select Approve.

  7. (Optional) For Decision comment, enter a response (up to 150 characters).

  8. Choose Save.

Review subscription request panel showing the requester name, the IAM execution role ARN, and the Approve and Reject radio buttons

After approval, Amazon SageMaker Unified Studio creates a Lake Formation grant for the execution role. Project members whose project uses that execution role can then see the asset in their data explorer and query it using the Query Editor or notebooks.

Reject a request

To reject a subscription request

  1. Navigate to Amazon SageMaker Unified Studio and choose Domain management to open the admin portal.

  2. In the left navigation pane under Catalog, choose Subscriptions.

  3. On the Requests tab, find the request you want to reject.

  4. In the Actions column, choose Actions, then choose View request.

  5. Under Decision details, select Reject.

  6. (Optional) For Decision comment, enter a response (up to 150 characters).

  7. Choose Save.

The requesting user sees the rejection status on their Subscriptions page. They can submit a new request with additional justification if needed.

Grant access directly

You can also grant access to an asset without waiting for someone to submit a request. You can grant access to a project (which resolves to the project's execution role) or directly to a specific IAM role.

To grant access directly

  1. Navigate to Amazon SageMaker Unified Studio and choose Domain management to open the admin portal.

  2. In the left navigation pane under Catalog, choose Browse.

  3. Choose the asset you want to share.

  4. Choose Actions, then choose Create subscription.

  5. In the Create subscription panel, for Principal type, choose Project or IAM role.

    • Project lets you select from the projects in the domain. The system grants access to the project's execution role.

    • IAM role lets you search for and select a specific IAM role ARN directly.

  6. For Select a project (or Find IAM role), choose the principals you want to grant access to.

  7. Choose Create.

After the subscription is created, the selected principals gain read access to the asset.

Create subscription panel showing the Principal type dropdown, the project selector, and read-only data permissions

View and manage existing grants

The Grants tab shows all active subscriptions across the domain. Each row shows the asset, who it was granted to, the status, and the date access was granted. The Granted to column shows either a project name (for project-level grants) or a full IAM role ARN (for role-level grants).

Grants tab showing subscriptions granted to both project names and IAM role ARNs, with Approved and Shared statuses

Use the Status filter to narrow the list:

  • Approved means access was granted through a subscription request that was approved.

  • Revoked means access was previously granted but has been revoked.

Grants created directly by an administrator (through Create subscription) show a status of Shared.

To view the full details of a grant, choose the menu icon in the Actions column, then choose View Details. The details panel shows who requested access, when it was approved, and the approver's comment.

Revoke access

Revoking a subscription removes the Lake Formation grant from the execution role. The IAM role can no longer query the underlying data for that asset.

To revoke access

  1. Navigate to Amazon SageMaker Unified Studio and choose Domain management to open the admin portal.

  2. In the left navigation pane under Catalog, choose Subscriptions.

  3. Choose the Grants tab.

  4. Find the grant you want to revoke. In the Actions column, choose Actions, then choose Revoke.

  5. In the Revoke access dialog, review the warning about downstream effects.

  6. For To confirm revoke, type "confirm", enter confirm.

  7. Choose Revoke.

Revoke access confirmation dialog showing the warning about downstream effects and the confirm text field

After revoking, the asset is no longer queryable by any project that uses the affected execution role. If they need access again, they must submit a new subscription request.