Configure seamless single sign-on with SQL analytics in Amazon SageMaker Unified Studio

Amazon SageMaker Unified Studio supplies a unified expertise for utilizing information, analytics, and AI capabilities. SageMaker Unified Studio now helps trusted identification propagation (TIP) for SQL workloads, enabling fine-grained information entry management based mostly on particular person consumer identities. Organizations can use this integration to handle information permissions via AWS Lake Formation whereas utilizing their current single sign-on (SSO) infrastructure.

Organizations already utilizing Amazon Redshift with TIP can prolong their current Lake Formation permissions to SageMaker Unified Studio. Customers merely log in via SSO and entry their approved information utilizing the SQL editor, sustaining constant safety controls throughout their analytics setting.

This publish demonstrates the right way to configure SageMaker Unified Studio with SSO, arrange initiatives and consumer onboarding, and entry information securely utilizing built-in analytics instruments.

Answer overview

For our use case, a retail company is planning to implement gross sales analytics to determine gross sales patterns and product classes which are doing nicely. This can assist the gross sales crew enhance on gross sales planning with focused promotions and assist the finance crew plan budgeting with higher stock administration. The company shops a buyer desk in an Amazon Easy Storage Service (Amazon S3) information lake and a store_sales desk in a Redshift cluster.

The company makes use of SageMaker Unified Studio because the UI, with customers onboarded from their identification supplier (IdP) to AWS IAM Identification Middle with TIP. Amazon SageMaker Lakehouse centralizes information from Amazon S3 and Amazon Redshift, and Lake Formation supplies fine-grained entry management based mostly on consumer identification. For our instance use case, we discover two totally different customers. The next desk summarizes their roles, the instruments they use, and their information entry.

Person	Group	Device	Knowledge Entry
Ethan (Knowledge Analyst)	Gross sales	Amazon Athena for interactive SQL evaluation	Non-sensitive buyer information (`id`, `c_country`, `birth_year`) and `store_sales` full desk entry
Frank (BI Analyst)	Finance	Amazon Redshift for stories and visualization	US buyer information (`c_country='US'`)

The next diagram illustrates the answer structure.

SageMaker Unified Studio with IAM Identification Middle simplifies the consumer journey from authentication to information evaluation. The workflow consists of the next steps:

Customers register with organizational SSO credentials via their IdP and are redirected to SageMaker Unified Studio.
Customers configure IAM Identification Middle authentication for Amazon Redshift, linking identification administration with information entry.
Customers entry the question editor for Amazon Redshift or SageMaker Lakehouse, triggering IAM Identification Middle federation to generate session and entry tokens.
SageMaker Unified Studio retrieves consumer authorization particulars and group membership utilizing the session token.
Customers are authenticated as IAM Identification Middle customers, able to discover and analyze information utilizing Amazon Redshift and Amazon Athena.

To implement our resolution, we stroll via the next high-level steps:

Arrange SageMaker Lakehouse assets.
Create a SageMaker Unified Studio area with SSO and TIP enabled.
Configure Amazon Redshift for TIP and validate entry.
Validate information entry utilizing Amazon Athena.

Conditions

Earlier than you start implementing the answer, it’s essential to have the next in place:

If you happen to don’t have an AWS account, you may enroll for one.
We offer utility scripts to assist arrange numerous sections of the publish. To make use of them:

Proper-click this hyperlink and save the utility scripts zip file.
Unzip the file to a terminal that has the AWS Command Line Interface (AWS CLI) configured. You too can use AWS CloudShell.
Run the scripts solely when prompted within the related sections.

Word: The utility scripts are configured for
us-east-1 area. If you happen to want one other area, edit the area within the scripts earlier than working them.

To deploy the infrastructure, right-click this hyperlink and choose ‘Save Hyperlink As’ to put it aside as sagemaker-unified-studio-infrastructure.yaml. Then add the file when creating a brand new stack within the AWS CloudFormation console, which can create the next assets:
1. An S3 bucket to carry the shopper information used on this publish.
2. An AWS Identification and Entry Administration (IAM) position referred to as DataTransferRole with permissions as outlined in Conditions for managing Amazon Redshift namespaces within the AWS Glue Knowledge Catalog.
3. An IAM position referred to as IAMIDCRedshiftRole, which shall be used later to arrange the IAM Identification Middle Redshift utility.
4. An IAM position referred to as LakeFormationRegistrationRole, following the directions in Necessities for roles used to register places, and obligatory IAM insurance policies.
If you happen to don’t have a Lake Formation consumer, you may create one. For this publish, we use an admin consumer. For directions, see Create a knowledge lake administrator.
If IAM Identification Middle will not be enabled, consult with Enabling AWS IAM Identification Middle for directions to allow it.
1. If you might want to migrate current Redshift customers and teams, use the IAM Identification Middle Redshift migration utility.
2. For a fast method to take a look at the function and familiarize your self with the method, we offer a script to generate mock customers and teams. Run the setup-idc.sh script, which is offered in Step 2, to create take a look at customers and teams in IAM Identification Middle for demonstration functions.
Combine IAM Identification Middle with Lake Formation. For directions, see Connecting Lake Formation with IAM Identification Middle.
Register the S3 bucket as a knowledge lake location:
1. On the Lake Formation console, select Knowledge lake places within the navigation pane.
2. Select Register location.
3. For the position, use LakeFormationRegistrationRole.
Create an IAM Identification Middle Redshift utility, as detailed in our earlier publish:
1. On the Amazon Redshift console, select IAM Identification Middle connections within the navigation pane and select Create utility.
2. For each the show identify and utility identify, enter redshift-idc-app.
3. Set the IdP namespace to awsidc.
4. Select IAMIDCRedshiftRole because the IAM position.
5. Select Subsequent to create the appliance.
6. Pay attention to the appliance Amazon Useful resource Title (ARN) to make use of in subsequent steps. The ARN format is arn:aws:sso::<ACCOUNT_NUMBER>:utility/ssoins-<RANDOM_STRING>/apl-<RANDOM_STRING>.
If you happen to don’t have current Redshift tables to work with, run the script setup-producer-redshift.sh, which is offered in Step 2, to create a producer namespace and workgroup, arrange a pattern gross sales database, and generate obligatory tables with take a look at information.
The publish additionally makes use of simulated buyer information saved within the AWS Glue Knowledge Catalog. To arrange this information and configure the required Lake Formation permissions, run the setup-glue-tables-and-access.sh script offered in Step 2.

Arrange SageMaker Lakehouse assets

On this part, we configure the foundational lakehouse assets required for SageMaker to entry and analyze information throughout a number of storage techniques. We’ll register the Redshift occasion to the AWS Glue Knowledge Catalog to make warehouse information discoverable and set up Lake Formation permissions on lakehouse assets for consumer identities to make sure safe, ruled entry to each information lake and information warehouse assets from inside SageMaker environments.

Register Redshift occasion to the Knowledge Catalog

On this step, we use the store_sales information, which we created earlier utilizing the setup-producer-redshift.sh script. You may register total clusters to the Knowledge Catalog and create catalogs managed by AWS Glue. To register a cluster to the Knowledge Catalog, full the next steps:

On the Lake Formation console, select Administrative roles and duties within the navigation pane.
Below Knowledge lake directors, select Add.
Select Learn-only administrator, then select AWSServiceRoleForRedshift.
On the Amazon Redshift console, open your namespace.
On the Actions dropdown menu, selected Register with AWS Glue Knowledge Catalog, then select Register.
Sign up to the Lake Formation console as the info lake administrator and select Catalogs within the navigation pane.
Below Pending catalog invites, choose the namespace and settle for the invitation by selecting Approve and create catalog.
Present the identify for the catalog as salescatalog.
Choose Entry this catalog from Apache Iceberg appropriate engines, select DataTransferRole for the IAM position, then select Subsequent.
Select Add permissions and select the admin IAM position below IAM customers and roles.
Choose Tremendous consumer for catalog permissions and select Add.
Select Subsequent.
Select Create catalog.

Arrange Lake Formation permission on lakehouse assets for consumer identities

On this part, we configure Lake Formation permissions to allow safe entry to lakehouse assets for federated consumer identities. Lake Formation supplies fine-grained entry management that works seamlessly with IAM Identification Middle, permitting you to handle permissions centrally whereas sustaining safety boundaries.

We’ll deal with granting database entry to IAM Identification Middle teams in Lake Formation and setting table-level permissions for federated Redshift catalog tables. These permissions kind the safety basis for our federated question structure, enabling customers to seamlessly entry each S3 information lake and Redshift information warehouse assets via a unified interface.

Grant database entry to IAM Identification Middle teams in Lake Formation

After you share your Redshift catalog with the Knowledge Catalog and combine with Lake Formation, it’s essential to grant applicable database entry. Comply with these steps to arrange permissions in your information lake assets for company identities:

On the Lake Formation console, below Permissions within the navigation pane, select Knowledge permissions.
Select Grant.
Choose Principals for Principal sort.
Below Principals, choose IAM Identification Middle and select Add.
Within the pop-up window, if that is your first time assigning customers and teams, select Get began.
Seek for and choose the IAM Identification Middle teams awssso-sales and awssso-finance.
Select Assign.
Below LF-Tags or catalog assets, select Named Knowledge Catalog assets.
1. Select <accountid>:salescatalog/dev for Catalogs.
2. Select sales_schema for Database.
Below Database permissions, choose Describe.
Select Grant to use the permissions.

Grant table-level permissions for federated Redshift catalog tables

Full the next steps to grant desk permissions to the IAM Identification Middle teams:

On the Lake Formation console, below Permissions within the navigation pane, select Knowledge permissions.
Select Grant.
Choose Principals for Principal sort.
Below Principals, choose IAM Identification Middle and select Add.
Within the pop-up window, if that is your first time assigning customers and teams, select Get began.
Seek for and choose the IAM Identification Middle group awssso-sales.
Select Assign.
Below LF-Tags or catalog assets, select Named Knowledge Catalog assets.
1. Select <accountid>:salescatalog/dev for Catalogs.
2. Select sales_schema for Database.
3. Select store_sales for Desk.
Choose Choose and Describe for Desk permissions.
Select Grant to use the permissions.

Create a SageMaker Unified Studio area with SSO and TIP enabled

For directions to create a SageMaker Unified Studio area, consult with Create an Amazon SageMaker Unified Studio area – fast setup. As a result of your IAM Identification Middle integration is already full, you may specify an IAM Identification Middle consumer within the area configuration settings.

Allow TIP in SageMaker Unified Studio

Full the next steps to allow TIP in SageMaker Unified Studio:

On the SageMaker console, use the AWS Area selector within the high navigation bar to decide on the suitable Area.
Select View domains and select the area’s identify from the record.
On the area’s particulars web page, on the Mission profiles tab, select a undertaking profile, for instance, SQL analytics.
Choose SQL analytics and select Edit.
Within the Blueprint parameters part, choose enableTrustedIdentityPropagationPermissions and select Edit.
Replace the worth as true.
To implement authorization-based on TIP, the SageMaker Unified Studio admin could make this parameter non-editable.
Select Save.

Allow consumer entry for SageMaker Unified Studio area

Full the next steps to allow consumer entry for the SageMaker Unified Studio area:

Open the SageMaker console within the applicable Area and select Domains within the navigation pane.
Select an current SageMaker Unified Studio area the place you wish to add SSO consumer entry.
On the area’s particulars web page, on the Person administration tab, within the Customers part, select Add and Add SSO customers and teams.
Select the consumer (for this publish, we add the consumer Frank) from the dropdown record and select Add customers and teams.

Add undertaking members

SageMaker Unified Studio initiatives facilitate crew collaboration for various enterprise initiatives. Because the undertaking proprietor, Ethan now can add Frank as a crew member to allow their collaboration. So as to add members to an current undertaking, full the next steps:

Sign up to the SageMaker Unified Studio console utilizing the SSO credentials of who owns the undertaking (for this publish, Ethan).
Select Choose a undertaking.
Select the undertaking you wish to edit.
On the Mission overview web page, increase Actions and select Handle members.
Select Add members.
Enter the identify of the consumer or group you wish to add (for this publish, we add Frank).
Choose Contributor if you wish to add the undertaking member as a contributor.
(Elective) Repeat these steps so as to add extra undertaking members. You may add as much as eight undertaking members at a time.
Select Add members.

Create a SQL analytics undertaking in Unified Studio

On this step, we federate into SageMaker Unified Studio and create a undertaking utilizing SQL analytics. Full the next steps:

Federate into SageMaker Unified Studio utilizing your IAM Identification Middle credentials:
1. On the SageMaker console, select Domains within the navigation pane.
2. Copy the SageMaker Unified Studio URL in your area and enter it into a brand new browser window.
3. Select Sign up with SSO.
4. A browser pop-up will redirect you to your most popular IdP login web page, the place you enter your IdP credentials.
5. If authentication if profitable, you’ll be redirected to SageMaker Unified Studio.
After logging in, select Create undertaking.
Enter a reputation in your undertaking. This undertaking identify is last and might’t be modified later.
(Elective) Enter an outline in your undertaking. You may edit this later.
Select a undertaking profile. For this demo, we select the SQL analytics profile from the out there templates.
Depart the default values as they’re or modify them in keeping with your use case, then select Proceed.
Select Create undertaking to finalize the undertaking and initialize your SQL analytics workspace.

For extra detailed data and superior configurations, consult with Create a undertaking.

Configure Amazon Redshift for TIP and validate entry

Run the setup-consumer-redshift.sh script (offered within the stipulations). This script will create a brand new namespace and workgroup and add the required tags, which you’ll use later to combine with SageMaker Unified Studio compute.

In case you are creating the cluster manually, add one of many following tags to the Redshift cluster or workgroup that you just wish to add to SageMaker Unified Studio:

Choice 1 – Add a tag to permit solely a selected SageMaker Unified Studio undertaking to entry it: AmazonDataZoneProject=<projectID>
Choice 2 – Add a tag to permit all SageMaker Unified Studio initiatives on this account to entry it: for-use-with-all-datazone-projects=true

Create compute utilizing IAM Identification Middle authentication

After you arrange your undertaking, the following step is to determine a compute useful resource connection on the SageMaker Unified Studio console. Comply with these steps so as to add both Amazon Redshift Serverless or a provisioned cluster to your undertaking setting:

Go to the Compute part of your undertaking in SageMaker Unified Studio.
On the Knowledge warehouse tab, select Add compute.
You may create a brand new compute useful resource or select an current one. For this publish, we select Connect with current compute assets, then select Subsequent.
Select the kind of compute useful resource you wish to add, then select Subsequent. For this publish, we select Redshift Serverless.
Below Connection properties, present the JDBC URL or the compute you wish to add, which is built-in with IAM Identification Middle. If the compute useful resource is in the identical account as your SageMaker Unified Studio undertaking, you may choose the compute useful resource from the dropdown menu. In our instance, we use the patron account that was simply provisioned.
Below Authentication, choose IAM Identification Middle.
For Title, enter the identify of the Redshift Serverless or provisioned cluster you wish to add.
For Description, enter an outline of the compute useful resource.
Select Add compute.

The SageMaker Unified Studio Mission Compute and Knowledge pages will now show data for that useful resource.

If every thing is configured appropriately, your compute shall be created utilizing IAM Identification Middle. As a result of your IdP credentials are already cached when you’re logged in to SageMaker Unified Studio, it makes use of the identical credentials and creates the compute.

Check information entry utilizing Amazon Redshift

When Ethan logs in to SageMaker Unified Studio utilizing IAM Identification Middle authentication, he efficiently federates and might entry buyer information from all nations however just for non-sensitive columns. Let’s hook up with Amazon Redshift in SageMaker Unified Studio by following these steps:

Select Actions and select Open Question editor.
Select Redshift within the Knowledge explorer pane.
Run the shopper gross sales calculation question to watch that consumer Ethan (a knowledge analyst) can entry buyer information from all nations however solely non-sensitive columns (id, birth_country, product_id):
```
choose current_user, c.*, sum(s.sales_amount) as total_sales
from "awsdatacatalog"."customerdb"."buyer" c
be part of "dev@salescatalog"."sales_schema"."store_sales" s 
on c.id=s.id
group by all;
```

You’ve got efficiently configured Redshift to make use of IAM Identification Middle authentication in SageMaker Unified Studio.

Validate information entry utilizing Amazon Athena

When Frank logs in to SageMaker Unified Studio utilizing IAM Identification Middle authentication, he efficiently federates and might entry buyer information just for america. To question with Athena, full the next steps:

Select Actions and select Open Question editor.
Select Lakehouse within the Knowledge explorer pane.
Discover AwsDataCatalog, increase the database, select the respective desk, and on the choices menu (three dots), select Preview information.

The next demonstration illustrates how consumer Frank, a BI analyst, can carry out SQL evaluation utilizing Athena. As a result of row-level filtering applied via Lake Formation, Frank’s entry is restricted to buyer information from america solely. Moreover, you may observe that within the Knowledge explorer pane, Frank can solely view the customerdb database. The dev@salescatalog database will not be seen to Frank as a result of no entry has been granted to his respective group from Lake Formation.

The IAM Identification Middle authentication integration is full; you should utilize each Amazon Redshift and Athena via SageMaker Unified Studio in a simplified, all-in-one interface.Word that, on the time of writing, Athena doesn’t work with Redshift Managed Storage (RMS).

Clear up

Full the next steps to scrub up the assets you created as a part of this publish:

Delete the info from the S3 bucket.
Delete the Knowledge Catalog objects.
Delete the Lake Formation assets and Athena account.
Delete the SageMaker Unified Studio undertaking and related area.
If you happen to created new Redshift cluster for testing this resolution, delete the cluster.

Conclusion

On this publish, we offered a complete information to enabling trusted identification propagation inside SageMaker Unified Studio. We lined the setup of a SageMaker Unified Studio area with SSO, the creation of tailor-made initiatives, environment friendly consumer onboarding with applicable permissions, and the administration of AWS Glue and Amazon Redshift managed catalog permissions utilizing Lake Formation. By sensible examples, we demonstrated the right way to use each Amazon Redshift and Athena inside SageMaker Unified Studio, showcasing safe information entry and evaluation capabilities. This method helps organizations preserve strict identification controls whereas serving to information scientists and analysts derive worthwhile insights from each information lake and information warehouse environments, supporting each safety and productiveness in machine studying workflows.

For extra data on this integration, consult with Trusted identification propagation.