AWS adds custom project permissions to SageMaker Unified Studio
AWS announced on October 29 that Amazon SageMaker Unified Studio supports custom designations: named permission sets controlling what project members can do. The feature adds differentiated access beyond the existing Owner and Contributor designations, which AWS describes as providing nearly identical permissions.
Administrators define designations at domain level and assign them within projects. Permissions cover areas such as Catalog, Subscriptions, Connections, Notebooks and Data Agent. AWS gives a data steward who approves subscription requests and publishes assets, and an analyst limited to queries and notebooks, as examples rather than mandatory role templates.
Every domain retains the two managed designations, Owner and Contributor, and supports up to ten additional custom designations. AWS’s implementation blog says the managed designations can be inspected but not edited or deleted. The aim is to let different members work in the same project with different responsibilities.
Direct assignment is not the only source of access. A member can inherit another designation through single sign-on group membership, and AWS says the effective permissions are the union of direct and group-inherited permission sets. A narrow direct assignment therefore does not necessarily remove broader permissions supplied by a group.
Designations complement IAM rather than replace it. AWS says an action first needs permission at the AWS API boundary and then through the project designation. Effective access also depends on resource policies, service control policies, permissions boundaries and configuration. The blog warns that Manage Membership permission can let a member assign a designation with more permissions than their own.
The feature is available in AWS Regions where SageMaker Unified Studio is offered. AWS’s October 30 blog says designations have no additional charge beyond the service itself and integrate with CloudFormation. They are a configurable permission mechanism, not an automatic guarantee of regulatory compliance or prevention of every unwanted agent action.