SageMaker Unified Studio Gets Custom Designations for Role-Based Permissions

Hi everyone, it's Shii-chan! Permissions in SageMaker Unified Studio just got much finer, so let me introduce it!

AWS What's New aws.amazon.com

What was announced?

AWS What's New announced custom designations for Amazon SageMaker Unified Studio.

A designation is a named permission set that controls what actions a project member can perform.

The story so far

Members could only be Owner or Contributor, and their permissions were nearly identical. There was no way to split access by your organization's personas.

What changes

Administrators can now define permission sets that match their personas and assign them to members.

Data engineers, stewards, analysts and automated pipelines can work in the same project with differentiated access, so you no longer need separate projects just to isolate permissions. It also gives you a single permission model for separation of duties.

Dive Deep

• Administrators create designations in the SageMaker Unified Studio administration portal
• Permissions are picked by category: Catalog, Subscriptions, Connections, Notebooks and Data Agent
• Each designation is defined at the domain level and can be assigned in any project in that domain
• When a member acts, the studio evaluates their designation and allows or denies the request
• Example: a "Data Steward" can approve subscription requests and publish assets, while an "Analyst" can only query data and run notebooks
• Every domain includes managed Owner and Contributor designations, and you can create up to 10 more

It is available in all Regions where SageMaker Unified Studio is available. The announcement doesn't mention pricing.

Wrap-up

• Create and assign custom permission sets as designations
• Defined per domain and usable across projects
• Up to 10 additional designations
• No more splitting projects just to separate roles

This is for administrators handling data governance and teams where several job roles share a project!