AWS Amazon SageMaker Domain

This page shows how to write Terraform and CloudFormation for Amazon SageMaker Domain and write them securely.

aws_sagemaker_domain (Terraform)

The Domain in Amazon SageMaker can be configured in Terraform with the resource name aws_sagemaker_domain. The following sections describe 5 examples of how to use the resource and its parameters.

Example Usage from GitHub

aws_sagemaker_domain.tf#L1
resource "aws_sagemaker_domain" "test" {
  domain_name = "examplea"
  auth_mode   = "IAM"
  vpc_id      = aws_vpc.test.id
  subnet_ids  = [aws_subnet.test.id]
  kms_key_id  = aws_kms_key.test.arn
aws_sagemaker_domain.tf#L1
resource "aws_sagemaker_domain" "pass" {
  domain_name = "examplea"
  auth_mode   = "IAM"
  vpc_id      = aws_vpc.test.id
  subnet_ids  = [aws_subnet.test.id]
  kms_key_id  = aws_kms_key.test.arn
aws_sagemaker_domain.tf#L1
resource "aws_sagemaker_domain" "pass" {
  domain_name = "examplea"
  auth_mode   = "IAM"
  vpc_id      = aws_vpc.test.id
  subnet_ids  = [aws_subnet.test.id]
  kms_key_id  = aws_kms_key.test.arn
aws_sagemaker_domain.tf#L1
resource "aws_sagemaker_domain" "pass" {
  domain_name = "examplea"
  auth_mode   = "IAM"
  vpc_id      = aws_vpc.test.id
  subnet_ids  = [aws_subnet.test.id]
  kms_key_id  = aws_kms_key.test.arn
aws_sagemaker_domain.tf#L1
resource "aws_sagemaker_domain" "pass" {
  domain_name = "examplea"
  auth_mode   = "IAM"
  vpc_id      = aws_vpc.test.id
  subnet_ids  = [aws_subnet.test.id]
  kms_key_id  = aws_kms_key.test.arn

Parameters

Explanation in Terraform Registry

Provides a Sagemaker Domain resource.

AWS::SageMaker::Domain (CloudFormation)

The Domain in SageMaker can be configured in CloudFormation with the resource name AWS::SageMaker::Domain. The following sections describe how to use the resource and its parameters.

Example Usage from GitHub

An example could not be found in GitHub.

Parameters

Explanation in CloudFormation Registry

Creates a Domain used by Amazon SageMaker Studio. A domain consists of an associated Amazon Elastic File System (EFS) volume, a list of authorized users, and a variety of security, application, policy, and Amazon Virtual Private Cloud (VPC) configurations. An AWS account is limited to one domain per region. Users within a domain can share notebook files and other artifacts with each other. EFS storage When a domain is created, an EFS volume is created for use by all of the users within the domain. Each user receives a private home directory within the EFS volume for notebooks, Git repositories, and data files.

SageMaker uses the AWS Key Management Service (AWS KMS) to encrypt the EFS volume attached to the domain with an AWS managed key by default. For more control, you can specify a customer managed key. For more information, see Protect Data at Rest Using Encryption. VPC configuration All SageMaker Studio traffic between the domain and the EFS volume is through the specified VPC and subnets. For other Studio traffic, you can specify the AppNetworkAccessType parameter. AppNetworkAccessType corresponds to the network access type that you choose when you onboard to Studio. The following options are available:+ PublicInternetOnly - Non-EFS traffic goes through a VPC managed by Amazon SageMaker, which allows internet access. This is the default value.

  • VpcOnly - All Studio traffic is through the specified VPC and subnets. Internet access is disabled by default. To allow internet access, you must specify a NAT gateway. When internet access is disabled, you won't be able to run a Studio notebook or to train or host models unless your VPC has an interface endpoint to the SageMaker API and runtime or a NAT gateway and your security groups allow outbound connections.

Important NFS traffic over TCP on port 2049 needs to be allowed in both inbound and outbound rules in order to launch a SageMaker Studio app successfully.

For more information, see Connect SageMaker Studio Notebooks to Resources in a VPC.

Frequently asked questions

What is AWS Amazon SageMaker Domain?

AWS Amazon SageMaker Domain is a resource for Amazon SageMaker of Amazon Web Service. Settings can be wrote in Terraform and CloudFormation.

Where can I find the example code for the AWS Amazon SageMaker Domain?

For Terraform, the JamesWoolfenden/check-encrypt, bridgecrewio/checkov and bridgecrewio/checkov source code examples are useful. See the Terraform Example section for further details.