Configure seamless single sign-on with SQL analytics in Amazon SageMaker Unified Studio

October 20, 2025

10

Amazon SageMaker Unified Studio gives a unified expertise for utilizing knowledge, analytics, and AI capabilities. SageMaker Unified Studio now helps trusted identification propagation (TIP) for SQL workloads, enabling fine-grained knowledge entry management based mostly on particular person person identities. Organizations can use this integration to handle knowledge permissions by means of AWS Lake Formation whereas utilizing their present single sign-on (SSO) infrastructure.

Organizations already utilizing Amazon Redshift with TIP can prolong their present Lake Formation permissions to SageMaker Unified Studio. Customers merely log in by means of SSO and entry their approved knowledge utilizing the SQL editor, sustaining constant safety controls throughout their analytics surroundings.

This put up demonstrates learn how to configure SageMaker Unified Studio with SSO, arrange initiatives and person onboarding, and entry knowledge securely utilizing built-in analytics instruments.

Resolution overview

For our use case, a retail company is planning to implement gross sales analytics to establish gross sales patterns and product classes which can be doing effectively. This can assist the gross sales group enhance on gross sales planning with focused promotions and assist the finance group plan budgeting with higher stock administration. The company shops a buyer desk in an Amazon Easy Storage Service (Amazon S3) knowledge lake and a store_sales desk in a Redshift cluster.

The company makes use of SageMaker Unified Studio because the UI, with customers onboarded from their identification supplier (IdP) to AWS IAM Id Heart with TIP. Amazon SageMaker Lakehouse centralizes knowledge from Amazon S3 and Amazon Redshift, and Lake Formation gives fine-grained entry management based mostly on person identification. For our instance use case, we discover two totally different customers. The next desk summarizes their roles, the instruments they use, and their knowledge entry.

Consumer	Group	Software	Information Entry
Ethan (Information Analyst)	Gross sales	Amazon Athena for interactive SQL evaluation	Non-sensitive buyer knowledge (`id`, `c_country`, `birth_year`) and `store_sales` full desk entry
Frank (BI Analyst)	Finance	Amazon Redshift for studies and visualization	US buyer knowledge (`c_country='US'`)

The next diagram illustrates the answer structure.

SageMaker Unified Studio with IAM Id Heart simplifies the person journey from authentication to knowledge evaluation. The workflow consists of the next steps:

Customers check in with organizational SSO credentials by means of their IdP and are redirected to SageMaker Unified Studio.
Customers configure IAM Id Heart authentication for Amazon Redshift, linking identification administration with knowledge entry.
Customers entry the question editor for Amazon Redshift or SageMaker Lakehouse, triggering IAM Id Heart federation to generate session and entry tokens.
SageMaker Unified Studio retrieves person authorization particulars and group membership utilizing the session token.
Customers are authenticated as IAM Id Heart customers, able to discover and analyze knowledge utilizing Amazon Redshift and Amazon Athena.

To implement our answer, we stroll by means of the next high-level steps:

Arrange SageMaker Lakehouse assets.
Create a SageMaker Unified Studio area with SSO and TIP enabled.
Configure Amazon Redshift for TIP and validate entry.
Validate knowledge entry utilizing Amazon Athena.

Conditions

Earlier than you start implementing the answer, you will need to have the next in place:

When you don’t have an AWS account, you may join for one.
We offer utility scripts to assist arrange numerous sections of the put up. To make use of them:

Proper-click this hyperlink and save the utility scripts zip file.
Unzip the file to a terminal that has the AWS Command Line Interface (AWS CLI) configured. You can even use AWS CloudShell.
Run the scripts solely when prompted within the related sections.

Word: The utility scripts are configured for
us-east-1 area. When you favor one other area, edit the area within the scripts earlier than operating them.

To deploy the infrastructure, right-click this hyperlink and choose ‘Save Hyperlink As’ to put it aside as sagemaker-unified-studio-infrastructure.yaml. Then add the file when creating a brand new stack within the AWS CloudFormation console, which can create the next assets:
1. An S3 bucket to carry the client knowledge used on this put up.
2. An AWS Id and Entry Administration (IAM) position known as DataTransferRole with permissions as outlined in Conditions for managing Amazon Redshift namespaces within the AWS Glue Information Catalog.
3. An IAM position known as IAMIDCRedshiftRole, which might be used later to arrange the IAM Id Heart Redshift software.
4. An IAM position known as LakeFormationRegistrationRole, following the directions in Necessities for roles used to register places, and vital IAM insurance policies.
When you don’t have a Lake Formation person, you may create one. For this put up, we use an admin person. For directions, see Create an information lake administrator.
If IAM Id Heart is just not enabled, seek advice from Enabling AWS IAM Id Heart for directions to allow it.
1. If you should migrate present Redshift customers and teams, use the IAM Id Heart Redshift migration utility.
2. For a fast technique to check the characteristic and familiarize your self with the method, we offer a script to generate mock customers and teams. Run the setup-idc.sh script, which is supplied in Step 2, to create check customers and teams in IAM Id Heart for demonstration functions.
Combine IAM Id Heart with Lake Formation. For directions, see Connecting Lake Formation with IAM Id Heart.
Register the S3 bucket as an information lake location:
1. On the Lake Formation console, select Information lake places within the navigation pane.
2. Select Register location.
3. For the position, use LakeFormationRegistrationRole.
Create an IAM Id Heart Redshift software, as detailed in our earlier put up:
1. On the Amazon Redshift console, select IAM Id Heart connections within the navigation pane and select Create software.
2. For each the show title and software title, enter redshift-idc-app.
3. Set the IdP namespace to awsidc.
4. Select IAMIDCRedshiftRole because the IAM position.
5. Select Subsequent to create the appliance.
6. Pay attention to the appliance Amazon Useful resource Title (ARN) to make use of in subsequent steps. The ARN format is arn:aws:sso:::software/ssoins-/apl-.
When you don’t have present Redshift tables to work with, run the script setup-producer-redshift.sh, which is supplied in Step 2, to create a producer namespace and workgroup, arrange a pattern gross sales database, and generate vital tables with check knowledge.
The put up additionally makes use of simulated buyer knowledge saved within the AWS Glue Information Catalog. To arrange this knowledge and configure the mandatory Lake Formation permissions, run the setup-glue-tables-and-access.sh script supplied in Step 2.

Arrange SageMaker Lakehouse assets

On this part, we configure the foundational lakehouse assets required for SageMaker to entry and analyze knowledge throughout a number of storage methods. We’ll register the Redshift occasion to the AWS Glue Information Catalog to make warehouse knowledge discoverable and set up Lake Formation permissions on lakehouse assets for person identities to make sure safe, ruled entry to each knowledge lake and knowledge warehouse assets from inside SageMaker environments.

Register Redshift occasion to the Information Catalog

On this step, we use the store_sales knowledge, which we created earlier utilizing the setup-producer-redshift.sh script. You may register whole clusters to the Information Catalog and create catalogs managed by AWS Glue. To register a cluster to the Information Catalog, full the next steps:

On the Lake Formation console, select Administrative roles and duties within the navigation pane.
Underneath Information lake directors, select Add.
Select Learn-only administrator, then select AWSServiceRoleForRedshift.
On the Amazon Redshift console, open your namespace.
On the Actions dropdown menu, selected Register with AWS Glue Information Catalog, then select Register.
Check in to the Lake Formation console as the info lake administrator and select Catalogs within the navigation pane.
Underneath Pending catalog invites, choose the namespace and settle for the invitation by selecting Approve and create catalog.
Present the title for the catalog as salescatalog.
Choose Entry this catalog from Apache Iceberg suitable engines, select DataTransferRole for the IAM position, then select Subsequent.
Select Add permissions and select the admin IAM position underneath IAM customers and roles.
Choose Tremendous person for catalog permissions and select Add.
Select Subsequent.
Select Create catalog.

Arrange Lake Formation permission on lakehouse assets for person identities

On this part, we configure Lake Formation permissions to allow safe entry to lakehouse assets for federated person identities. Lake Formation gives fine-grained entry management that works seamlessly with IAM Id Heart, permitting you to handle permissions centrally whereas sustaining safety boundaries.

We’ll concentrate on granting database entry to IAM Id Heart teams in Lake Formation and setting table-level permissions for federated Redshift catalog tables. These permissions type the safety basis for our federated question structure, enabling customers to seamlessly entry each S3 knowledge lake and Redshift knowledge warehouse assets by means of a unified interface.

Grant database entry to IAM Id Heart teams in Lake Formation

After you share your Redshift catalog with the Information Catalog and combine with Lake Formation, you will need to grant acceptable database entry. Comply with these steps to arrange permissions in your knowledge lake assets for company identities:

On the Lake Formation console, underneath Permissions within the navigation pane, select Information permissions.
Select Grant.
Choose Principals for Principal sort.
Underneath Principals, choose IAM Id Heart and select Add.
Within the pop-up window, if that is your first time assigning customers and teams, select Get began.
Seek for and choose the IAM Id Heart teams awssso-sales and awssso-finance.
Select Assign.
Underneath LF-Tags or catalog assets, select Named Information Catalog assets.
1. Select :salescatalog/dev for Catalogs.
2. Select sales_schema for Database.
Underneath Database permissions, choose Describe.
Select Grant to use the permissions.

Grant table-level permissions for federated Redshift catalog tables

Full the next steps to grant desk permissions to the IAM Id Heart teams:

On the Lake Formation console, underneath Permissions within the navigation pane, select Information permissions.
Select Grant.
Choose Principals for Principal sort.
Underneath Principals, choose IAM Id Heart and select Add.
Within the pop-up window, if that is your first time assigning customers and teams, select Get began.
Seek for and choose the IAM Id Heart group awssso-sales.
Select Assign.
Underneath LF-Tags or catalog assets, select Named Information Catalog assets.
1. Select :salescatalog/dev for Catalogs.
2. Select sales_schema for Database.
3. Select store_sales for Desk.
Choose Choose and Describe for Desk permissions.
Select Grant to use the permissions.

Create a SageMaker Unified Studio area with SSO and TIP enabled

For directions to create a SageMaker Unified Studio area, seek advice from Create an Amazon SageMaker Unified Studio area – fast setup. As a result of your IAM Id Heart integration is already full, you may specify an IAM Id Heart person within the area configuration settings.

Allow TIP in SageMaker Unified Studio

Full the next steps to allow TIP in SageMaker Unified Studio:

On the SageMaker console, use the AWS Area selector within the prime navigation bar to decide on the suitable Area.
Select View domains and select the area’s title from the record.
On the area’s particulars web page, on the Challenge profiles tab, select a mission profile, for instance, SQL analytics.
Choose SQL analytics and select Edit.
Within the Blueprint parameters part, choose enableTrustedIdentityPropagationPermissions and select Edit.
Replace the worth as true.
To implement authorization-based on TIP, the SageMaker Unified Studio admin could make this parameter non-editable.
Select Save.

Allow person entry for SageMaker Unified Studio area

Full the next steps to allow person entry for the SageMaker Unified Studio area:

Open the SageMaker console within the acceptable Area and select Domains within the navigation pane.
Select an present SageMaker Unified Studio area the place you wish to add SSO person entry.
On the area’s particulars web page, on the Consumer administration tab, within the Customers part, select Add and Add SSO customers and teams.
Select the person (for this put up, we add the person Frank) from the dropdown record and select Add customers and teams.

Add mission members

SageMaker Unified Studio initiatives facilitate group collaboration for various enterprise initiatives. Because the mission proprietor, Ethan now can add Frank as a group member to allow their collaboration. So as to add members to an present mission, full the next steps:

Check in to the SageMaker Unified Studio console utilizing the SSO credentials of who owns the mission (for this put up, Ethan).
Select Choose a mission.
Select the mission you wish to edit.
On the Challenge overview web page, increase Actions and select Handle members.
Select Add members.
Enter the title of the person or group you wish to add (for this put up, we add Frank).
Choose Contributor if you wish to add the mission member as a contributor.
(Non-compulsory) Repeat these steps so as to add extra mission members. You may add as much as eight mission members at a time.
Select Add members.

Create a SQL analytics mission in Unified Studio

On this step, we federate into SageMaker Unified Studio and create a mission utilizing SQL analytics. Full the next steps:

Federate into SageMaker Unified Studio utilizing your IAM Id Heart credentials:
1. On the SageMaker console, select Domains within the navigation pane.
2. Copy the SageMaker Unified Studio URL to your area and enter it into a brand new browser window.
3. Select Check in with SSO.
4. A browser pop-up will redirect you to your most well-liked IdP login web page, the place you enter your IdP credentials.
5. If authentication if profitable, you may be redirected to SageMaker Unified Studio.
After logging in, select Create mission.
Enter a reputation to your mission. This mission title is last and might’t be modified later.
(Non-compulsory) Enter an outline to your mission. You may edit this later.
Select a mission profile. For this demo, we select the SQL analytics profile from the obtainable templates.
Go away the default values as they’re or modify them in line with your use case, then select Proceed.
Select Create mission to finalize the mission and initialize your SQL analytics workspace.

For extra detailed data and superior configurations, seek advice from Create a mission.

Configure Amazon Redshift for TIP and validate entry

Run the setup-consumer-redshift.sh script (supplied within the conditions). This script will create a brand new namespace and workgroup and add the required tags, which you’ll use later to combine with SageMaker Unified Studio compute.

If you’re creating the cluster manually, add one of many following tags to the Redshift cluster or workgroup that you just wish to add to SageMaker Unified Studio:

Possibility 1 – Add a tag to permit solely a particular SageMaker Unified Studio mission to entry it: AmazonDataZoneProject=
Possibility 2 – Add a tag to permit all SageMaker Unified Studio initiatives on this account to entry it: for-use-with-all-datazone-projects=true

Create compute utilizing IAM Id Heart authentication

After you arrange your mission, the following step is to ascertain a compute useful resource connection on the SageMaker Unified Studio console. Comply with these steps so as to add both Amazon Redshift Serverless or a provisioned cluster to your mission surroundings:

Go to the Compute part of your mission in SageMaker Unified Studio.
On the Information warehouse tab, select Add compute.
You may create a brand new compute useful resource or select an present one. For this put up, we select Hook up with present compute assets, then select Subsequent.
Select the kind of compute useful resource you wish to add, then select Subsequent. For this put up, we select Redshift Serverless.
Underneath Connection properties, present the JDBC URL or the compute you wish to add, which is built-in with IAM Id Heart. If the compute useful resource is in the identical account as your SageMaker Unified Studio mission, you may choose the compute useful resource from the dropdown menu. In our instance, we use the patron account that was simply provisioned.
Underneath Authentication, choose IAM Id Heart.
For Title, enter the title of the Redshift Serverless or provisioned cluster you wish to add.
For Description, enter an outline of the compute useful resource.
Select Add compute.

The SageMaker Unified Studio Challenge Compute and Information pages will now show data for that useful resource.

If the whole lot is configured accurately, your compute might be created utilizing IAM Id Heart. As a result of your IdP credentials are already cached when you’re logged in to SageMaker Unified Studio, it makes use of the identical credentials and creates the compute.

Check knowledge entry utilizing Amazon Redshift

When Ethan logs in to SageMaker Unified Studio utilizing IAM Id Heart authentication, he efficiently federates and might entry buyer knowledge from all nations however just for non-sensitive columns. Let’s hook up with Amazon Redshift in SageMaker Unified Studio by following these steps:

Select Actions and select Open Question editor.
Select Redshift within the Information explorer pane.
Run the client gross sales calculation question to watch that person Ethan (an information analyst) can entry buyer knowledge from all nations however solely non-sensitive columns (id, birth_country, product_id):
```
choose current_user, c.*, sum(s.sales_amount) as total_sales
from "awsdatacatalog"."customerdb"."buyer" c
be part of "dev@salescatalog"."sales_schema"."store_sales" s 
on c.id=s.id
group by all;
```

You’ve efficiently configured Redshift to make use of IAM Id Heart authentication in SageMaker Unified Studio.

Validate knowledge entry utilizing Amazon Athena

When Frank logs in to SageMaker Unified Studio utilizing IAM Id Heart authentication, he efficiently federates and might entry buyer knowledge just for the USA. To question with Athena, full the next steps:

Select Actions and select Open Question editor.
Select Lakehouse within the Information explorer pane.
Discover AwsDataCatalog, increase the database, select the respective desk, and on the choices menu (three dots), select Preview knowledge.

The next demonstration illustrates how person Frank, a BI analyst, can carry out SQL evaluation utilizing Athena. On account of row-level filtering carried out by means of Lake Formation, Frank’s entry is restricted to buyer knowledge from the USA solely. Moreover, you may observe that within the Information explorer pane, Frank can solely view the customerdb database. The dev@salescatalog database is just not seen to Frank as a result of no entry has been granted to his respective group from Lake Formation.

The IAM Id Heart authentication integration is full; you should utilize each Amazon Redshift and Athena by means of SageMaker Unified Studio in a simplified, all-in-one interface.Word that, on the time of writing, Athena doesn’t work with Redshift Managed Storage (RMS).

Clear up

Full the next steps to scrub up the assets you created as a part of this put up:

Delete the info from the S3 bucket.
Delete the Information Catalog objects.
Delete the Lake Formation assets and Athena account.
Delete the SageMaker Unified Studio mission and related area.
When you created new Redshift cluster for testing this answer, delete the cluster.

Conclusion

On this put up, we supplied a complete information to enabling trusted identification propagation inside SageMaker Unified Studio. We lined the setup of a SageMaker Unified Studio area with SSO, the creation of tailor-made initiatives, environment friendly person onboarding with acceptable permissions, and the administration of AWS Glue and Amazon Redshift managed catalog permissions utilizing Lake Formation. Via sensible examples, we demonstrated learn how to use each Amazon Redshift and Athena inside SageMaker Unified Studio, showcasing safe knowledge entry and evaluation capabilities. This strategy helps organizations preserve strict identification controls whereas serving to knowledge scientists and analysts derive beneficial insights from each knowledge lake and knowledge warehouse environments, supporting each safety and productiveness in machine studying workflows.

For extra data on this integration, seek advice from Trusted identification propagation.

Concerning the authors

Previous articleWhy Machine Pace Wants Machine Belief

Next articleThis is How the iOS 26.1 Transparency Toggle Adjustments Liquid Glass