Trusted Identity Propagation with Studio

View the Live Documentation

The Challenge

Trusted Identity Propagation addresses a critical enterprise need: maintaining user identity context as data scientists work across multiple AWS services. Before this feature, enterprises faced significant challenges:

• Identity fragmentation: Users had to manage multiple IAM roles when accessing different AWS services, losing their individual identity context
• Audit complexity: Tracking which specific user performed actions across services was difficult when all actions appeared under shared execution roles
• Access control limitations: Fine-grained permissions based on user attributes (like group membership) were hard to implement across service boundaries
• Cross-team coordination: Setting up the feature required collaboration between SageMaker administrators and IAM Identity Center administrators

My Approach

• Multi-audience documentation: Created separate paths for SageMaker administrators and IAM Identity Center administrators, recognizing that setup requires collaboration between different teams with different expertise.
• Architecture-first explanation: Started with clear architecture documentation to help readers understand how identity context flows between services before diving into configuration steps.
• Service-specific integration guides: Created dedicated pages for each connected service (S3 Access Grants, EMR, EMR Serverless, Redshift Data API, Lake Formation, Athena) with service-specific prerequisites and configuration.
• Security and compliance focus: Emphasized auditing capabilities with CloudTrail integration, helping enterprises meet compliance requirements.
• Edge case documentation: Documented user background sessions and other advanced scenarios that enterprise users would encounter.

Documentation Structure

I designed an information architecture that guides administrators through the complex setup process:

• Trusted identity propagation — Overview and use cases
  • Architecture and compatibility — Technical architecture, prerequisites
  • Set up — Configuration steps for both SageMaker and IAM Identity Center
  • Audit with CloudTrail — Compliance and monitoring
  • User background sessions — Advanced session management
  • Connect with other AWS services — Integration guides
    • Connect to Amazon S3 Access Grants
      • Studio JupyterLab notebooks with Amazon S3 Access Grants
      • Training and Processing jobs with Amazon S3 Access Grants
    • Connect to Amazon EMR
    • Connect to EMR Serverless
    • Connect to Redshift Data API
    • Connect to Lake Formation and Athena

Technical Depth

This documentation required deep understanding of enterprise identity management and cross-service AWS architecture:

• IAM Identity Center integration: Documented how user attributes and group associations flow from Identity Center to connected services
• Token exchange mechanisms: Explained how identity context is propagated without requiring users to re-authenticate
• Service-specific authorization: Each connected service has different authorization models that needed to be documented clearly
• CloudTrail event structure: Documented how to interpret audit logs to track user-specific actions across services

Connected Services Documentation

A major component of this work was documenting integrations with multiple AWS services, each with unique requirements:

Enterprise Focus

This documentation was specifically designed for enterprise customers with complex identity and compliance requirements:

• Compliance enablement: Detailed CloudTrail integration for audit trails
• Least privilege support: User attribute-based access control
• Cross-team workflows: Clear handoff points between admin teams
• Scalability considerations: Documentation for large-scale deployments