JA EN
shiichan

Did you know you can now scope SageMaker Notebook data access per user?

AWS What's New ★★★★ View Markdown
#aws#security#ai

Hey everyone, it's Shii! Today I've got an update about access control in SageMaker.

AWS What's New aws.amazon.com

What was announced?

According to AWS's What's New, Amazon SageMaker Notebooks now support Trusted Identity Propagation (TIP). TIP works with Amazon Athena, Amazon Redshift, and Amazon EMR Serverless to enable per-user access control for data analytics.

The story so far

Until now, when a notebook accessed a data analytics backend, permissions were typically bundled together at the level of the notebook's execution role. That made it hard to finely separate which tables, columns, and rows each individual notebook user should be allowed to see, so teams often ended up granting one role broader permissions than they'd like.

What changes

When you use TIP-enabled compute in a TIP-enabled Project, the notebook user's own IAM Identity Center identity now flows all the way through to AWS Lake Formation. That means only the tables, columns, and rows that user's permissions allow become visible, and you no longer need to share a broadly scoped execution role.

Here are the concrete benefits:

  • Per-user data boundaries enforced based on who is actually running the query
  • Full audit attribution, since CloudTrail records which user accessed which data
  • Less admin friction, since identity propagates automatically through the connection, with no extra login, token, or role management needed

Dive Deep

Getting started is simple: just use a notebook with the supported engines (Athena, Redshift, EMR Serverless) inside a TIP-enabled Project. It's available in all AWS Regions where Amazon SageMaker Unified Studio is available. For detailed setup, the original article points to the "Trusted identity propagation" page in the SageMaker Unified Studio Administrator Guide and the "Notebooks" page in the User Guide.

Wrap-up

  • SageMaker Notebooks now support Trusted Identity Propagation for Athena, Redshift, and EMR Serverless
  • Enables fine-grained, per-user data access control plus CloudTrail-based auditing
  • Removes the need for a broadly scoped shared execution role

If your team accesses data analytics backends from shared SageMaker Notebooks, or you care about data governance, this update is worth a look!

Related posts