Request Syntax Request Parameters Response Syntax Response Elements Errors See Also

CreateDomain

Creates a Domain used by Amazon SageMaker Studio. A domain consists of an associated Amazon Elastic File System (EFS) volume, a list of authorized users, and a variety of security, application, policy, and Amazon Virtual Private Cloud (VPC) configurations. An Amazon account is limited to one domain per region. Users within a domain can share notebook files and other artifacts with each other.

EFS storage

When a domain is created, an EFS volume is created for use by all of the users within the domain. Each user receives a private home directory within the EFS volume for notebooks, Git repositories, and data files.

SageMaker uses the Amazon Key Management Service (Amazon KMS) to encrypt the EFS volume attached to the domain with an Amazon managed key by default. For more control, you can specify a customer managed key. For more information, see Protect Data at Rest Using Encryption.

VPC configuration

All SageMaker Studio traffic between the domain and the EFS volume is through the specified VPC and subnets. For other Studio traffic, you can specify the AppNetworkAccessType parameter. AppNetworkAccessType corresponds to the network access type that you choose when you onboard to Studio. The following options are available:

PublicInternetOnly - Non-EFS traffic goes through a VPC managed by Amazon SageMaker, which allows internet access. This is the default value.
VpcOnly - All Studio traffic is through the specified VPC and subnets. Internet access is disabled by default. To allow internet access, you must specify a NAT gateway.

When internet access is disabled, you won't be able to run a Studio notebook or to train or host models unless your VPC has an interface endpoint to the SageMaker API and runtime or a NAT gateway and your security groups allow outbound connections.

Important

NFS traffic over TCP on port 2049 needs to be allowed in both inbound and outbound rules in order to launch a SageMaker Studio app successfully.

For more information, see Connect SageMaker Studio Notebooks to Resources in a VPC.

Request Syntax


{
   "AppNetworkAccessType": "string",
   "AppSecurityGroupManagement": "string",
   "AuthMode": "string",
   "DefaultUserSettings": { 
      "CanvasAppSettings": { 
         "TimeSeriesForecastingSettings": { 
            "AmazonForecastRoleArn": "string",
            "Status": "string"
         }
      },
      "ExecutionRole": "string",
      "JupyterServerAppSettings": { 
         "DefaultResourceSpec": { 
            "InstanceType": "string",
            "LifecycleConfigArn": "string",
            "SageMakerImageArn": "string",
            "SageMakerImageVersionArn": "string"
         },
         "LifecycleConfigArns": [ "string" ]
      },
      "KernelGatewayAppSettings": { 
         "CustomImages": [ 
            { 
               "AppImageConfigName": "string",
               "ImageName": "string",
               "ImageVersionNumber": number
            }
         ],
         "DefaultResourceSpec": { 
            "InstanceType": "string",
            "LifecycleConfigArn": "string",
            "SageMakerImageArn": "string",
            "SageMakerImageVersionArn": "string"
         },
         "LifecycleConfigArns": [ "string" ]
      },
      "RSessionAppSettings": { 
         "CustomImages": [ 
            { 
               "AppImageConfigName": "string",
               "ImageName": "string",
               "ImageVersionNumber": number
            }
         ],
         "DefaultResourceSpec": { 
            "InstanceType": "string",
            "LifecycleConfigArn": "string",
            "SageMakerImageArn": "string",
            "SageMakerImageVersionArn": "string"
         }
      },
      "RStudioServerProAppSettings": { 
         "AccessStatus": "string",
         "UserGroup": "string"
      },
      "SecurityGroups": [ "string" ],
      "SharingSettings": { 
         "NotebookOutputOption": "string",
         "S3KmsKeyId": "string",
         "S3OutputPath": "string"
      },
      "TensorBoardAppSettings": { 
         "DefaultResourceSpec": { 
            "InstanceType": "string",
            "LifecycleConfigArn": "string",
            "SageMakerImageArn": "string",
            "SageMakerImageVersionArn": "string"
         }
      }
   },
   "DomainName": "string",
   "DomainSettings": { 
      "ExecutionRoleIdentityConfig": "string",
      "RStudioServerProDomainSettings": { 
         "DefaultResourceSpec": { 
            "InstanceType": "string",
            "LifecycleConfigArn": "string",
            "SageMakerImageArn": "string",
            "SageMakerImageVersionArn": "string"
         },
         "DomainExecutionRoleArn": "string",
         "RStudioConnectUrl": "string",
         "RStudioPackageManagerUrl": "string"
      },
      "SecurityGroupIds": [ "string" ]
   },
   "HomeEfsFileSystemKmsKeyId": "string",
   "KmsKeyId": "string",
   "SubnetIds": [ "string" ],
   "Tags": [ 
      { 
         "Key": "string",
         "Value": "string"
      }
   ],
   "VpcId": "string"
}

Request Parameters

For information about the parameters that are common to all actions, see Common Parameters.

The request accepts the following data in JSON format.

AppNetworkAccessType

Specifies the VPC used for non-EFS traffic. The default value is PublicInternetOnly.

PublicInternetOnly - Non-EFS traffic is through a VPC managed by Amazon SageMaker, which allows direct internet access
VpcOnly - All Studio traffic is through the specified VPC and subnets

Type: String

Valid Values: PublicInternetOnly | VpcOnly

Required: No

AppSecurityGroupManagement

The entity that creates and manages the required security groups for inter-app communication in VPCOnly mode. Required when CreateDomain.AppNetworkAccessType is VPCOnly and DomainSettings.RStudioServerProDomainSettings.DomainExecutionRoleArn is provided.

Type: String

Valid Values: Service | Customer

Required: No

AuthMode

The mode of authentication that members use to access the domain.

Type: String

Valid Values: SSO | IAM

Required: Yes

DefaultUserSettings

The default settings to use to create a user profile when UserSettings isn't specified in the call to the CreateUserProfile API.

SecurityGroups is aggregated when specified in both calls. For all other settings in UserSettings, the values specified in CreateUserProfile take precedence over those specified in CreateDomain.

Type: UserSettings object

Required: Yes

DomainName

A name for the domain.

Type: String

Length Constraints: Maximum length of 63.

Pattern: ^[a-zA-Z0-9](-*[a-zA-Z0-9]){0,62}

Required: Yes

DomainSettings

A collection of Domain settings.

Type: DomainSettings object

Required: No

HomeEfsFileSystemKmsKeyId

This parameter has been deprecated.

Use KmsKeyId.

Type: String

Length Constraints: Maximum length of 2048.

Pattern: .*

Required: No

KmsKeyId

SageMaker uses Amazon KMS to encrypt the EFS volume attached to the domain with an Amazon managed key by default. For more control, specify a customer managed key.

Type: String

Length Constraints: Maximum length of 2048.

Pattern: .*

Required: No

SubnetIds

The VPC subnets that Studio uses for communication.

Type: Array of strings

Array Members: Minimum number of 1 item. Maximum number of 16 items.

Length Constraints: Maximum length of 32.

Pattern: [-0-9a-zA-Z]+

Required: Yes

Tags

Tags to associated with the Domain. Each tag consists of a key and an optional value. Tag keys must be unique per resource. Tags are searchable using the Search API.

Tags that you specify for the Domain are also added to all Apps that the Domain launches.

Type: Array of Tag objects

Array Members: Minimum number of 0 items. Maximum number of 50 items.

Required: No

VpcId

The ID of the Amazon Virtual Private Cloud (VPC) that Studio uses for communication.

Type: String

Length Constraints: Maximum length of 32.

Pattern: [-0-9a-zA-Z]+

Required: Yes

Response Syntax


{
   "DomainArn": "string",
   "Url": "string"
}

Response Elements

If the action is successful, the service sends back an HTTP 200 response.

The following data is returned in JSON format by the service.

DomainArn

The Amazon Resource Name (ARN) of the created domain.

Type: String

Length Constraints: Maximum length of 256.

Pattern: arn:aws[a-z\-]*:sagemaker:[a-z0-9\-]*:[0-9]{12}:domain/.*

Url

The URL to the created domain.

Type: String

Length Constraints: Maximum length of 1024.

Errors

For information about the errors that are common to all actions, see Common Errors.

ResourceInUse

Resource being accessed is in use.

HTTP Status Code: 400

ResourceLimitExceeded

You have exceeded an SageMaker resource limit. For example, you might have too many training jobs created.

HTTP Status Code: 400