Custom onboarding to Amazon SageMaker domain using IAM

To onboard to domain using IAM

1. Open the SageMaker console.

2. On the left navigation pane, choose Admin configurations.

3. Under Admin configurations, choose domains.

4. From the domains page, choose Create domain.

5. On the Setup SageMaker domain page, choose Set up for organizations.

6. Select Configure.

1. For domain Name, enter a unique name for your domain. For example, this can be your project or team name.

2. Choose Next.

1. Under How do you want to access Studio?, choose Login through IAM.

2. Under Who will use Studio? add the user profile names. To add a user profile name, choose Add user, enter a user profile name, then choose Select.

3. Under What ML activities do they perform? you can use an existing role by choosing Use an existing role or you can create a new role by choosing Create a new role and checking the ML activities to which you wish the role to have access. You can select at most 10 ML activities.

4. While selecting ML activities, you may need to satisfy requirements. To satisfy a requirement, choose Add and complete the requirement.

5. After all requirements are satisfied, choose Next.

1. Under S3 location for shareable notebook resources, input your Amazon S3 location.

2. Under Encryption key - optional, leave as No Custom Encryption or choose an existing Amazon KMS key or choose Enter a KMS key ARN and enter your Amazon KMS key's ARN.

3. Under Notebook cell output sharing preference, choose Allow users to share cell output or Disable cell output sharing.

1. Under RStudio Workbench, verify that your RStudio license is automatically detected. For more information about getting an RStudio license and activating it with SageMaker, see RStudio license.

2. Select an instance type to launch your RStudio Server on. For more information, see RStudioServerPro instance type.

3. Under Permission, create your role or select an existing role. The role must have the following permissions policy. This policy allows the RStudioServerPro application to access necessary resources. It also allows Amazon SageMaker to automatically launch an RStudioServerPro app when the existing RStudioServerPro application is in a Deleted or Failed status. For information about adding permissions to a role, see Modifying a role permissions policy (console).

   {
       "Version": "2012-10-17",
       "Statement": [
           {
               "Sid": "VisualEditor0",
               "Effect": "Allow",
               "Action": [
                   "license-manager:ExtendLicenseConsumption",
                   "license-manager:ListReceivedLicenses",
                   "license-manager:GetLicense",
                   "license-manager:CheckoutLicense",
                   "license-manager:CheckInLicense",
                   "logs:CreateLogDelivery",
                   "logs:CreateLogGroup",
                   "logs:CreateLogStream",
                   "logs:DeleteLogDelivery",
                   "logs:Describe*",
                   "logs:GetLogDelivery",
                   "logs:GetLogEvents",
                   "logs:ListLogDeliveries",
                   "logs:PutLogEvents",
                   "logs:PutResourcePolicy",
                   "logs:UpdateLogDelivery",
                   "sagemaker:CreateApp"
               ],
               "Resource": "*"
           }
       ]
   }    

4. Under RStudio Connect, add the URL for your RStudio Connect server. RStudio Connect is a publishing platform for Shiny applications, R Markdown reports, dashboards, plots, and more. When you onboard to RStudio on SageMaker, an RStudio Connect server is not created. For more information, see RStudio Connect URL.

5. Under RStudio Package Manager, add the URL for your RStudio Package Manager. SageMaker creates a default package repository for the Package Manager when you onboard RStudio. For more information about RStudio Package Manager, see RStudio Package Manager.

6. Select Next.

1. Under VPC, choose the Amazon VPC ID.

2. Under Subnet, choose one or more subnets. If you don't choose any subnets, SageMaker uses all the subnets in the Amazon VPC. We recommend that you use multiple subnets that are not created in constrained Availability Zones. Using subnets in these constrained Availability Zones can result in insufficient capacity errors and longer application creation times. For more information about constrained Availability Zones, see Availability Zones.

3. Under Security group(s), choose one or more subnets.

1. Create an execution role that is used to create a domain and attach the AmazonSageMakerFullAccess policy. You can also use an existing role that has, at a minimum, an attached trust policy that grants SageMaker permission to assume the role. For more information, see SageMaker Roles.

   aws iam create-role --role-name execution-role-name
   aws iam attach-role-policy --role-name execution-role-name --policy-arn arn:aws:iam::aws:policy/AmazonSageMakerFullAccess

2. Get the default Amazon Virtual Private Cloud (Amazon VPC) of your account.

   aws --region region ec2 describe-vpcs --filters Name=isDefault,Values=true --query "Vpcs[0].VpcId" --output text

3. Get the list of subnets in the default Amazon VPC.

   aws --region region ec2 describe-subnets --filters Name=vpc-id,Values=default-vpc-id --query "Subnets[*].SubnetId" --output json

4. Create a domain by passing the default Amazon VPC ID, subnets, and execution role ARN. You must also pass a SageMaker image ARN. For information on the available JupyterLab version ARNs, see Setting a default JupyterLab version.

   aws --region region sagemaker create-domain --domain-name domain-name --vpc-id default-vpc-id --subnet-ids subnet-ids --auth-mode IAM --default-user-settings "ExecutionRole=arn:aws:iam::account-number:role/execution-role-name,JupyterServerAppSettings={DefaultResourceSpec={InstanceType=system,SageMakerImageArn=image-arn}}" \ --query DomainArn --output text

5. Verify that the domain has been created.

   aws --region region sagemaker  list-domains