Services or capabilities described in Amazon Web Services documentation might vary by Region. To see the differences applicable to the China Regions, see Getting Started with Amazon Web Services in China (PDF).

Create an Amazon SageMaker domain with RStudio using the Amazon CLI

The following topic shows how to onboard to Amazon SageMaker domain with RStudio enabled using the Amazon CLI. To onboard using the Amazon Web Services Management Console, see Amazon SageMaker domain overview.

Prerequisites

Create DomainExecution role

To launch the RStudio App, you must provide a DomainExecution role. This role is used to determine whether RStudio needs to be launched as part of Amazon SageMaker domain creation. This role is also used by Amazon SageMaker to access the RStudio License and push RStudio logs. 

The following procedure shows how to create the DomainExecution role with the Amazon CLI.

Create Amazon SageMaker domain with RStudio App

The RStudioServerPro app is launched automatically when you create a Amazon SageMaker domain using the create-domain CLI command with the RStudioServerProDomainSettings parameter specified. When launching the RStudioServerPro App, Amazon SageMaker checks for a valid RStudio license in the account and fails domain creation if the license is not found.

The creation of a Amazon SageMaker domain differs based on the authentication method and the network type. These options must be used together, with one authentication method and one network connection type selected. For more information about the requirements to create a new domain, see CreateDomain.

The following authentication methods are supported.

The following network connection types are supported:

Authentication methods

IAM Auth Mode

The following shows how to create a Amazon SageMaker domain with RStudio enabled and an IAM Auth Network Type. For more information about Amazon Identity and Access Management, see What is IAM?.

aws sagemaker create-domain --region <REGION> --domain-name <DOMAIN_NAME> \
    --auth-mode IAM \
    --default-user-settings ExecutionRole=<DEFAULT_USER_EXECUTIONROLE> \
    --domain-settings RStudioServerProDomainSettings={RStudioPackageManagerUrl=<<PACKAGE_MANAGER_URL>,RStudioConnectUrl=<<CONNECT_URL>,DomainExecutionRoleArn=<DOMAINEXECUTION_ROLE_ARN>} \
    --vpc-id <VPC_ID> \
    --subnet-ids <SUBNET_IDS> \
    --app-network-access-type <NETWORK_ACCESS_TYPE>

Authentication using IAM Identity Center

The following shows how to create a Amazon SageMaker domain with RStudio enabled and an SSO Auth Network Type. Amazon IAM Identity Center must be enabled for the region that the domain is launched on. For more information about IAM Identity Center, see What is Amazon IAM Identity Center?.

aws sagemaker create-domain --region <REGION> --domain-name <DOMAIN_NAME> \
    --auth-mode SSO \
    --default-user-settings ExecutionRole=<DEFAULT_USER_EXECUTIONROLE> \
    --domain-settings RStudioServerProDomainSettings={RStudioPackageManagerUrl=<<PACKAGE_MANAGER_URL>,RStudioConnectUrl=<<CONNECT_URL>,DomainExecutionRoleArn=<DOMAINEXECUTION_ROLE_ARN>} \
    --vpc-id <VPC_ID> \
    --subnet-ids <SUBNET_IDS> \
    --app-network-access-type <NETWORK_ACCESS_TYPE>

Connection types

PublicInternet/Direct Internet network type

The following shows how to create a Amazon SageMaker domain with RStudio enabled and a PublicInternet Network Type.

aws sagemaker create-domain --region <REGION> --domain-name <DOMAIN_NAME> \
    --auth-mode <AUTH_MODE> \
    --default-user-settings ExecutionRole=<DEFAULT_USER_EXECUTIONROLE> \
    --domain-settings RStudioServerProDomainSettings={RStudioPackageManagerUrl=<<PACKAGE_MANAGER_URL>,RStudioConnectUrl=<<CONNECT_URL>,DomainExecutionRoleArn=<DOMAINEXECUTION_ROLE_ARN>} \
    --vpc-id <VPC_ID> \
    --subnet-ids <SUBNET_IDS> \
    --app-network-access-type PublicInternetOnly

VPCOnly mode

The following shows how to launch a Amazon SageMaker domain with RStudio enabled and a VPCOnly Network Type. For more information about using the VPCOnly network access type, see Connect Studio notebooks in a VPC to external resources.

With RStudio, Amazon SageMaker manages security groups for you. This means that Amazon SageMaker manages security group rules to ensure RSessions can access RStudioServerPro Apps. Amazon SageMaker creates one security group rule per user profile.

aws sagemaker create-domain --region <REGION> --domain-name <DOMAIN_NAME> \
    --auth-mode <AUTH_MODE> \
    --default-user-settings SecurityGroups=<USER_SECURITY_GROUP>,ExecutionRole=<DEFAULT_USER_EXECUTIONROLE> \
    --domain-settings SecurityGroupIds=<DOMAIN_SECURITY_GROUP>,RStudioServerProDomainSettings={DomainExecutionRoleArn=<DOMAINEXECUTION_ROLE_ARN>} \
    --vpc-id <VPC_ID> \
    --subnet-ids "<SUBNET_IDS>" \
    --app-network-access-type VPCOnly --app-security-group-management Service

Note: The RStudioServerPro app is launched by a special user profile named domain-shared. As a result, this app is not returned as part of list-app API calls by any other user profiles.

You may have to increase the Amazon VPC quota in your account to increase the number of users. For more information, see Amazon VPC quotas.

Verify domain creation

Use the following command to verify that your domain has been created with a Status of InService. Your domain-id is appended to the domains ARN. For example, arn:aws:sagemaker:<REGION>:<ACCOUNT_ID>:domain/<DOMAIN_ID>.

aws sagemaker describe-domain --domain-id <DOMAIN_ID> --region <REGION>