Phase 1: Migrate the UI from Studio Classic to Studio

1. Create a test domain to verify configurations before migrating the existing domain.

2. Migrate the existing domain.

3. Clean up the test domain.

1. Get the domain ID of your existing domain.

   1. Open the Amazon SageMaker console at https://console.aws.amazon.com/sagemaker/.

   2. From the left navigation pane, expand Admin configurations and choose Domains.

   3. Choose the existing domain.

   4. On the Domain details page, choose the Domain settings tab.

   5. Copy the Domain ID.

2. Add the domain ID of your existing domain.

   export REF_DOMAIN_ID="domain-id"
   export SM_REGION="region"

3. Use describe-domain to get important information about the existing domain.

   export REF_EXECROLE=$(aws sagemaker describe-domain --region=$SM_REGION --domain-id=$REF_DOMAIN_ID | jq -r '.DefaultUserSettings.ExecutionRole')
   export REF_VPC=$(aws sagemaker describe-domain --region=$SM_REGION --domain-id=$REF_DOMAIN_ID | jq -r '.VpcId')
   export REF_SIDS=$(aws sagemaker describe-domain --region=$SM_REGION --domain-id=$REF_DOMAIN_ID | jq -r '.SubnetIds | join(",")')
   export REF_SGS=$(aws sagemaker describe-domain --region=$SM_REGION --domain-id=$REF_DOMAIN_ID | jq -r '.DefaultUserSettings.SecurityGroups | join(",")')
   export AUTHMODE=$(aws sagemaker describe-domain --region=$SM_REGION --domain-id=$REF_DOMAIN_ID | jq -r '.AuthMode')

4. Validate the parameters.

   echo "Execution Role: $REF_EXECROLE || VPCID: $REF_VPC || SubnetIDs: $REF_SIDS || Security GroupIDs: $REF_SGS || AuthMode: $AUTHMODE"

5. Create a test domain using the configurations from the existing domain.

   IFS=',' read -r -a subnet_ids <<< "$REF_SIDS"
   IFS=',' read -r -a security_groups <<< "$REF_SGS"
   security_groups_json=$(printf '%s\n' "${security_groups[@]}" | jq -R . | jq -s .)
   
   aws sagemaker create-domain \
   --domain-name "TestV2Config" \
   --vpc-id $REF_VPC \
   --auth-mode $AUTHMODE \
   --subnet-ids "${subnet_ids[@]}" \
   --app-network-access-type VpcOnly \
   --default-user-settings "
   {
       \"ExecutionRole\": \"$REF_EXECROLE\",
       \"StudioWebPortal\": \"ENABLED\",
       \"DefaultLandingUri\": \"studio::\",
       \"SecurityGroups\": $security_groups_json
   }
   "

6. After the test domain is In Service, use the test domain's ID to create a user profile. This user profile is used to launch and test applications.

   aws sagemaker create-user-profile \
   --region="$SM_REGION" --domain-id=test-domain-id \
   --user-profile-name test-network-user

1. Create an Amazon Identity and Access Management policy with one of the following contents by following the steps in Creating IAM policies:

   • Use the following policy to grant permissions for all application types and spaces.

     Note

     If the test domain uses the SageMakerFullAccess policy, you do not need to perform this action. SageMakerFullAccess grants permissions to create all applications.

     {
         "Version": "2012-10-17",
         "Statement": [
             {
                 "Sid": "SMStudioUserProfileAppPermissionsCreateAndDelete",
                 "Effect": "Allow",
                 "Action": [
                     "sagemaker:CreateApp",
                     "sagemaker:DeleteApp"
                 ],
                 "Resource": "arn:aws:sagemaker:region:account-id:app/*",
                 "Condition": {
                     "Null": {
                         "sagemaker:OwnerUserProfileArn": "true"
                     }
                 }
             },
             {
                 "Sid": "SMStudioCreatePresignedDomainUrlForUserProfile",
                 "Effect": "Allow",
                 "Action": [
                     "sagemaker:CreatePresignedDomainUrl"
                 ],
                 "Resource": "arn:aws:sagemaker:region:account-id:user-profile/${sagemaker:DomainId}/${sagemaker:UserProfileName}"
             },
             {
                 "Sid": "SMStudioAppPermissionsListAndDescribe",
                 "Effect": "Allow",
                 "Action": [
                     "sagemaker:ListApps",
                     "sagemaker:ListDomains",
                     "sagemaker:ListUserProfiles",
                     "sagemaker:ListSpaces",
                     "sagemaker:DescribeApp",
                     "sagemaker:DescribeDomain",
                     "sagemaker:DescribeUserProfile",
                     "sagemaker:DescribeSpace"
                 ],
                 "Resource": "*"
             },
             {
                 "Sid": "SMStudioAppPermissionsTagOnCreate",
                 "Effect": "Allow",
                 "Action": [
                     "sagemaker:AddTags"
                 ],
                 "Resource": "arn:aws:sagemaker:region:account-id:*/*",
                 "Condition": {
                     "Null": {
                         "sagemaker:TaggingAction": "false"
                     }
                 }
             },
             {
                 "Sid": "SMStudioRestrictSharedSpacesWithoutOwners",
                 "Effect": "Allow",
                 "Action": [
                     "sagemaker:CreateSpace",
                     "sagemaker:UpdateSpace",
                     "sagemaker:DeleteSpace"
                 ],
                 "Resource": "arn:aws:sagemaker:region:account-id:space/${sagemaker:DomainId}/*",
                 "Condition": {
                     "Null": {
                         "sagemaker:OwnerUserProfileArn": "true"
                     }
                 }
             },
             {
                 "Sid": "SMStudioRestrictSpacesToOwnerUserProfile",
                 "Effect": "Allow",
                 "Action": [
                     "sagemaker:CreateSpace",
                     "sagemaker:UpdateSpace",
                     "sagemaker:DeleteSpace"
                 ],
                 "Resource": "arn:aws:sagemaker:region:account-id:space/${sagemaker:DomainId}/*",
                 "Condition": {
                     "ArnLike": {
                         "sagemaker:OwnerUserProfileArn": "arn:aws:sagemaker:us-east-1:account-id:user-profile/${sagemaker:DomainId}/${sagemaker:UserProfileName}"
                     },
                     "StringEquals": {
                         "sagemaker:SpaceSharingType": [
                             "Private",
                             "Shared"
                         ]
                     }
                 }
             },
             {
                 "Sid": "SMStudioRestrictCreatePrivateSpaceAppsToOwnerUserProfile",
                 "Effect": "Allow",
                 "Action": [
                     "sagemaker:CreateApp",
                     "sagemaker:DeleteApp"
                 ],
                 "Resource": "arn:aws:sagemaker:region:account-id:app/${sagemaker:DomainId}/*",
                 "Condition": {
                     "ArnLike": {
                         "sagemaker:OwnerUserProfileArn": "arn:aws:sagemaker:us-east-1:account-id:user-profile/${sagemaker:DomainId}/${sagemaker:UserProfileName}"
                     },
                     "StringEquals": {
                         "sagemaker:SpaceSharingType": [
                             "Private"
                         ]
                     }
                 }
             },
             {
                 "Sid": "AllowAppActionsForSharedSpaces",
                 "Effect": "Allow",
                 "Action": [
                     "sagemaker:CreateApp",
                     "sagemaker:DeleteApp"
                 ],
                 "Resource": "arn:aws:sagemaker:*:*:app/${sagemaker:DomainId}/*/*/*",
                 "Condition": {
                     "StringEquals": {
                         "sagemaker:SpaceSharingType": [
                             "Shared"
                         ]
                     }
                 }
             }
         ]
     }

   • Because Studio shows an expanded set of applications, users may have access to applications that weren't displayed before. Administrators can limit access to these default applications by creating an Amazon Identity and Access Management (IAM) policy that grants denies permissions for some applications to specific users.

     Note

     Application type can be either jupyterlab or codeeditor.

     {  
       "Version": "2012-10-17",
       "Statement": [
         {
           "Sid": "DenySageMakerCreateAppForSpecificAppTypes",
           "Effect": "Deny",
           "Action": "sagemaker:CreateApp",
           "Resource": "arn:aws:sagemaker:region:account-id:app/domain-id/*/app-type/*"
         }
       ]
     }

2. Attach the policy to the execution role of the test domain. For instructions, follow the steps in Adding IAM identity permissions (console).

To add a CORS configuration to an Amazon S3 bucket

1. Verify that there is an Amazon S3 bucket in the same Amazon Web Services Region as the existing domain with the following name. For instructions, see Viewing the properties for an Amazon S3 bucket.

   sagemaker-region-account-id

2. Add a CORS configuration with the following content to the default Amazon S3 bucket. For instructions, see Configuring cross-origin resource sharing (CORS).

   [
       {
           "AllowedHeaders": [
               "*"
           ],
           "AllowedMethods": [
               "POST",
               "PUT",
               "GET",
               "HEAD",
               "DELETE"
           ],
           "AllowedOrigins": [
               "https://*.sagemaker.aws"
           ],
           "ExposeHeaders": [
               "ETag",
               "x-amz-delete-marker",
               "x-amz-id-2",
               "x-amz-request-id",
               "x-amz-server-side-encryption",
               "x-amz-version-id"
           ]
       }
   ]

To grant permissions for Data Wrangler functionality inside Canvas

1. Attach the Amazon managed policy AmazonSageMakerFullAccess to your user’s IAM role. For a procedure that shows you how to attach IAM policies to a role, see Adding IAM identity permissions (console) in the Amazon IAM User Guide.

   If this permissions policy is too permissive for your use case, you can create scoped-down policies that include at least the following permissions:

   {
       "Sid": "AllowStudioActions",
       "Effect": "Allow",
       "Action": [
           "sagemaker:CreatePresignedDomainUrl",
           "sagemaker:DescribeDomain",
           "sagemaker:ListDomains",
           "sagemaker:DescribeUserProfile",
           "sagemaker:ListUserProfiles",
           "sagemaker:DescribeSpace",
           "sagemaker:ListSpaces",
           "sagemaker:DescribeApp",
           "sagemaker:ListApps"
       ],
       "Resource": "*"
   },
   {
       "Sid": "AllowAppActionsForUserProfile",
       "Effect": "Allow",
       "Action": [
           "sagemaker:CreateApp",
           "sagemaker:DeleteApp"
       ],
       "Resource": "arn:aws:sagemaker:region:account-id:app/domain-id/user-profile-name/canvas/*",
       "Condition": {
           "Null": {
               "sagemaker:OwnerUserProfileArn": "true"
           }
       }
   }

2. Attach the Amazon managed policy AmazonSageMakerCanvasDataPrepFullAccess to your user’s IAM role.

To attach IAM policies to an execution role

1. Find the execution role attached to your SageMaker user profile

   1. In the SageMaker console https://console.amazonaws.cn/sagemaker/, navigate to Domains, then choose your SageMaker domain.

   2. The execution role ARN is listed under Execution role on the User Details page of your user profile. Make note of the execution role name in the ARN.

   3. In the IAM console https://console.amazonaws.cn/iam/, choose Roles.

   4. Search for your role by name in the search field.

   5. Select the role.

2. Add policies to the role

   1. In the IAM console https://console.amazonaws.cn/iam/, choose Roles.

   2. Search for your role by name in the search field.

   3. Select the role.

   4. In the Permissions tab, navigate to the dropdown menu Add permissions.

   5. • For managed policies: Select Attach policies, search for the name of the manage policy you want to attach.

        Select the policy then choose Add permissions.

      • For inline policies: Select Create inline policy, paste your policy in the JSON tab, choose next, name your policy, and choose Create.

1. Add the test domain's ID.

   export TEST_DOMAIN="test-domain-id"
   export SM_REGION="region"

2. List all applications in the domain that are in a running state.

   active_apps_json=$(aws sagemaker list-apps --region=$SM_REGION --domain-id=$TEST_DOMAIN)
   echo $active_apps_json

3. Parse the JSON list of running applications and delete them. If users attempted to create an application that they do not have permissions for, there may be spaces that are not captured in the following script. You must manually delete these spaces.

   echo "$active_apps_json" | jq -c '.Apps[]' | while read -r app;
   do
       if echo "$app" | jq -e '. | has("SpaceName")' > /dev/null;
       then
           app_type=$(echo "$app" | jq -r '.AppType')
           app_name=$(echo "$app" | jq -r '.AppName')
           domain_id=$(echo "$app" | jq -r '.DomainId')
           space_name=$(echo "$app" | jq -r '.SpaceName')
   
           echo "Deleting App - AppType: $app_type || AppName: $app_name || DomainId: $domain_id || SpaceName: $space_name"
           aws sagemaker delete-app --region=$SM_REGION --domain-id=$domain_id \
           --app-type $app_type --app-name $app_name --space-name $space_name
   
           echo "Deleting Space - AppType: $app_type || AppName: $app_name || DomainId: $domain_id || SpaceName: $space_name"
           aws sagemaker delete-space --region=$SM_REGION --domain-id=$domain_id \
           --space-name $space_name
       else
   
           app_type=$(echo "$app" | jq -r '.AppType')
           app_name=$(echo "$app" | jq -r '.AppName')
           domain_id=$(echo "$app" | jq -r '.DomainId')
           user_profile_name=$(echo "$app" | jq -r '.UserProfileName')
   
           echo "Deleting Studio Classic - AppType: $app_type || AppName: $app_name || DomainId: $domain_id || UserProfileName: $user_profile_name"
           aws sagemaker delete-app --region=$SM_REGION --domain-id=$domain_id \
           --app-type $app_type --app-name $app_name --user-profile-name $user_profile_name
   
       fi
   
   done

4. Delete the test user profile.

   aws sagemaker delete-user-profile \
   --region=$SM_REGION --domain-id=$TEST_DOMAIN \
   --user-profile-name "test-network-user"

5. Delete the test domain.

   aws sagemaker delete-domain \
   --region=$SM_REGION --domain-id=$TEST_DOMAIN