Several data teams use the same SageMaker Unified Studio domain, but each project handles different data.
Users should perform only work for their project; domain administration and other projects' data must remain restricted.
Which authentication and authorization design is most appropriate?
Align IAM roles and policies with the Unified Studio domain and project boundaries, separating project work from domain administration.
Detailed explanation
Users can cross project boundaries and perform domain-wide administration.
Users can cross project boundaries and perform domain-wide administration.
Reading audit events does not authenticate principals or grant effective permissions.
Reading audit events does not authenticate principals or grant effective permissions.
Only the data and job operations needed by the project are permitted, preserving a distinct identity boundary.
Only the data and job operations needed by the project are permitted, preserving a distinct identity boundary.
Public access provides neither user authentication nor project-level separation.
Public access provides neither user authentication nor project-level separation.
Check official documentation
Compare the following points with the official documentation.
SageMaker Unified Studio domains/projects、IAM roles、IAM policy evaluationの公式説明を確認する。
Official references
What to confirm
管理者権限の一括付与、公開設定、監査ログ参照と、プロジェクト境界に沿った認証設計の違いを説明できる。
Key points
- SageMaker Unified Studio
- Domain
- Project
- IAM role
Notes
- Environment: AWS公式DEA-C01試験ガイドと各サービスの公式ドキュメントの確認
- Confirm the relevant DEA-C01 Skill and current AWS service documentation.
Foundation review
Boundary
Keep domain administration separate from project-level data and job operations.
Least privilege
Grant only the actions and resources required for the project task.