Getting started with using Amazon SageMaker Canvas

Run Studio Applications – These permissions are necessary to start up the Canvas application.

Canvas Core Access – These permissions grant you access to the Canvas application and the basic functionality of Canvas, such as creating datasets, using basic data transforms, and building and analyzing models.

(Optional) Canvas Data Preparation (powered by Data Wrangler) – These permissions grant you access to create data flows and use advanced transforms to prepare your data in Canvas. These permissions are also necessary for creating data processing jobs and data preparation job schedules.

(Optional) Canvas AI Services – These permissions grant you access to the Ready-to-use models, foundation models, and Chat with Data features in Canvas.

(Optional) Kendra access – This permission grants you access to the document querying feature, where you can query documents stored in an Amazon Kendra index using foundation models in Canvas.

If you select this option, then in the Canvas Kendra Access section, enter the IDs for your Amazon Kendra indexes to which you want to grant access.

(Optional) Canvas MLOps – This permission grants you access to the model deployment feature in Canvas, where you can deploy models for use in production.

Local file upload. The permissions for local file upload are turned on by default in the Canvas base permissions when setting up your domain. If you can't upload local files from your machine to SageMaker Canvas, you can attach a CORS policy to the Amazon S3 bucket that you specified in the Canvas storage configuration. If you allowed SageMaker to use the default bucket, the bucket follows the naming pattern s3://sagemaker-{Region}-{your-account-id}. For more information, see Grant Your Users Permissions to Upload Local Files.

Custom image and text prediction models. The permissions for building custom image and text prediction models are turned on by default in the Canvas base permissions when setting up your domain. However, if you have a custom IAM configuration and don't want to attach the AmazonSageMakerCanvasFullAccess policy to your user's IAM execution role, then you must explicitly grant your user the necessary permissions. For more information, see Grant Your Users Permissions to Build Custom Image and Text Prediction Models.

Ready-to-use models and foundation models. You might want to use the Canvas Ready-to-use models to make predictions for your data. With the Ready-to-use models permissions, you can also chat with generative AI-powered models. The permissions are turned on by default when setting up your domain, or you can edit the permissions for a domain that you’ve already created. The Canvas Ready-to-use models permissions option adds the AmazonSageMakerCanvasAIServicesAccess policy to your execution role. For more information, see the Get started section of the Ready-to-use models documentation.

For more information about getting started with generative AI foundation models, see Use generative AI with foundation models.

Fine-tune foundation models. If you'd like to fine-tune foundation models in Canvas, you can either add the permissions when setting up your domain, or you can edit the permissions for the domain or user profile after creating your domain. You must add the AmazonSageMakerCanvasAIServicesAccess policy to the Amazon IAM role you chose when setting up the user profile, and you must also add a trust relationship with Amazon Bedrock to the role. For instructions on how to add these permissions to your IAM role, see Grant Users Permissions to Fine-tune Foundation Models.

Time series forecasting. If you’d like to perform forecasts on time series data, you can add time series forecasting permissions when setting up your domain, or you can edit the permissions for a domain or user profile after creating your domain. The required permissions are the AmazonSageMakerCanvasForecastAccess managed policy and a trust relationship with Amazon Forecast to the Amazon IAM role you chose when setting up the user profile. For instructions on how to add these permissions to your IAM role, see Grant Your Users Permissions to Perform Time Series Forecasting.

Send batch predictions to Amazon QuickSight. You might want to send batch predictions, or datasets of predictions you generate from a custom model, to Amazon QuickSight for analysis. In QuickSight, you can build and publish predictive dashboards with your prediction results. For instructions on how to add these permissions to your Canvas user's IAM role, see Grant Your Users Permissions to Send Predictions to Amazon QuickSight.

Deploy Canvas models to a SageMaker endpoint. SageMaker Hosting offers endpoints which you can use to deploy your model for use in production. You can deploy models built in Canvas to a SageMaker endpoint and then make predictions programmatically in a production environment. For more information, see Deploy your models to an endpoint.

Register model versions to the model registry. You might want to register versions of your model to the SageMaker model registry, which is a repository for tracking the status of updated versions of your model. A data scientist or MLOps team working in the SageMaker model registry can view the versions of your model that you’ve built and approve or reject them. Then, they can deploy your model version to production or kick off an automated workflow. Model registration permissions are turned on by default for your domain. You can manage permissions at the user profile level and grant or remove permissions to specific users. For more information, see Register a model version in the SageMaker model registry.

Collaboration with data scientists. If you want to collaborate with Studio Classic users and share models, you must add additional permissions to the Amazon IAM role you chose when setting up the user profile. For instructions on how to add the policy to the role, see Grant Users Permissions to Collaborate with Studio Classic.

Import data from Amazon Redshift. If you want to import data from Amazon Redshift, you must give yourself additional permissions. You must add the AmazonRedshiftFullAccess managed policy to the Amazon IAM role you chose when setting up the user profile. For instructions on how to add the policy to the role, see Grant Users Permissions to Import Amazon Redshift Data.

In the SageMaker console, choose the Canvas in the left navigation pane. Then, on the Canvas page, select your user from the dropdown and launch the Canvas application.

Open SageMaker Studio, and in the Studio interface, go to the Canvas page and launch the Canvas application.

Use your organization’s SAML 2.0-based SSO methods, such as Okta or the IAM Identity Center.

Ready-to-use models. With Ready-to-use models, you can use pre-built models to extract insights from your data. The Ready-to-use models cover a variety of use cases, such as language detection and document analysis. To get started making predictions with Ready-to-use models, see Use Ready-to-use models.

Custom models. With custom models, you can build a variety of model types that are customized to make predictions for your data. Use custom models if you’d like to build a model that is trained on your business-specific data and if you’d like to use features such as collaborating with data scientists and evaluating your model’s performance. To get started with building a custom model, see Use custom models.