AWS Amazon SageMaker Domain
This page shows how to write Terraform and CloudFormation for Amazon SageMaker Domain and write them securely.
aws_sagemaker_domain (Terraform)
The Domain in Amazon SageMaker can be configured in Terraform with the resource name aws_sagemaker_domain. The following sections describe 5 examples of how to use the resource and its parameters.
Example Usage from GitHub
resource "aws_sagemaker_domain" "test" {
domain_name = "examplea"
auth_mode = "IAM"
vpc_id = aws_vpc.test.id
subnet_ids = [aws_subnet.test.id]
kms_key_id = aws_kms_key.test.arn
resource "aws_sagemaker_domain" "pass" {
domain_name = "examplea"
auth_mode = "IAM"
vpc_id = aws_vpc.test.id
subnet_ids = [aws_subnet.test.id]
kms_key_id = aws_kms_key.test.arn
resource "aws_sagemaker_domain" "pass" {
domain_name = "examplea"
auth_mode = "IAM"
vpc_id = aws_vpc.test.id
subnet_ids = [aws_subnet.test.id]
kms_key_id = aws_kms_key.test.arn
resource "aws_sagemaker_domain" "pass" {
domain_name = "examplea"
auth_mode = "IAM"
vpc_id = aws_vpc.test.id
subnet_ids = [aws_subnet.test.id]
kms_key_id = aws_kms_key.test.arn
resource "aws_sagemaker_domain" "pass" {
domain_name = "examplea"
auth_mode = "IAM"
vpc_id = aws_vpc.test.id
subnet_ids = [aws_subnet.test.id]
kms_key_id = aws_kms_key.test.arn
Parameters
-
app_network_access_typeoptional - string -
arnoptional computed - string -
auth_moderequired - string -
domain_namerequired - string -
home_efs_file_system_idoptional computed - string -
idoptional computed - string -
kms_key_idoptional - string -
single_sign_on_managed_application_instance_idoptional computed - string -
subnet_idsrequired - set of string -
tagsoptional - map from string to string -
urloptional computed - string -
vpc_idrequired - string -
default_user_settingslist block-
execution_rolerequired - string -
security_groupsoptional - set of string -
jupyter_server_app_settingslist block-
default_resource_speclist block-
instance_typeoptional - string -
sagemaker_image_arnoptional - string
-
-
-
kernel_gateway_app_settingslist block-
custom_imagelist block-
app_image_config_namerequired - string -
image_namerequired - string -
image_version_numberoptional - number
-
-
default_resource_speclist block-
instance_typeoptional - string -
sagemaker_image_arnoptional - string
-
-
-
sharing_settingslist block-
notebook_output_optionoptional - string -
s3_kms_key_idoptional - string -
s3_output_pathoptional - string
-
-
tensor_board_app_settingslist block-
default_resource_speclist block-
instance_typeoptional - string -
sagemaker_image_arnoptional - string
-
-
-
Explanation in Terraform Registry
Provides a Sagemaker Domain resource.
AWS::SageMaker::Domain (CloudFormation)
The Domain in SageMaker can be configured in CloudFormation with the resource name AWS::SageMaker::Domain. The following sections describe how to use the resource and its parameters.
Example Usage from GitHub
An example could not be found in GitHub.
Parameters
-
AppNetworkAccessTypeoptional - String -
AuthModerequired - String -
DefaultUserSettingsrequired - UserSettings -
DomainNamerequired - String -
KmsKeyIdoptional - String -
SubnetIdsrequired - List -
Tagsoptional - List of Tag -
VpcIdrequired - String
Explanation in CloudFormation Registry
Creates a
Domainused by Amazon SageMaker Studio. A domain consists of an associated Amazon Elastic File System (EFS) volume, a list of authorized users, and a variety of security, application, policy, and Amazon Virtual Private Cloud (VPC) configurations. An AWS account is limited to one domain per region. Users within a domain can share notebook files and other artifacts with each other. EFS storage When a domain is created, an EFS volume is created for use by all of the users within the domain. Each user receives a private home directory within the EFS volume for notebooks, Git repositories, and data files.SageMaker uses the AWS Key Management Service (AWS KMS) to encrypt the EFS volume attached to the domain with an AWS managed key by default. For more control, you can specify a customer managed key. For more information, see Protect Data at Rest Using Encryption. VPC configuration All SageMaker Studio traffic between the domain and the EFS volume is through the specified VPC and subnets. For other Studio traffic, you can specify the
AppNetworkAccessTypeparameter.AppNetworkAccessTypecorresponds to the network access type that you choose when you onboard to Studio. The following options are available:+PublicInternetOnly- Non-EFS traffic goes through a VPC managed by Amazon SageMaker, which allows internet access. This is the default value.
VpcOnly- All Studio traffic is through the specified VPC and subnets. Internet access is disabled by default. To allow internet access, you must specify a NAT gateway. When internet access is disabled, you won't be able to run a Studio notebook or to train or host models unless your VPC has an interface endpoint to the SageMaker API and runtime or a NAT gateway and your security groups allow outbound connections.Important NFS traffic over TCP on port 2049 needs to be allowed in both inbound and outbound rules in order to launch a SageMaker Studio app successfully.
For more information, see Connect SageMaker Studio Notebooks to Resources in a VPC.
Frequently asked questions
What is AWS Amazon SageMaker Domain?
AWS Amazon SageMaker Domain is a resource for Amazon SageMaker of Amazon Web Service. Settings can be wrote in Terraform and CloudFormation.
Where can I find the example code for the AWS Amazon SageMaker Domain?
For Terraform, the JamesWoolfenden/check-encrypt, bridgecrewio/checkov and bridgecrewio/checkov source code examples are useful. See the Terraform Example section for further details.
