docs(sagemaker): add IAM Identity Center access guide and template - #49
Open
man-running wants to merge 1 commit into
Open
man-running wants to merge 1 commit into
man-running wants to merge 1 commit into
Conversation
Document the federated path to sagemaker:InvokeEndpoint for orgs whose users come from Entra ID, Okta or another IdP, as an alternative to the long-lived access key created by the invoke-user runbook. Covers the platform-team setup (MiruInvoke permission set, group assignment, provisioning check) by console or CloudFormation, the per-developer `aws configure sso`, what SSO session expiry looks like from Miru and its MCP server, OIDC roles for CI, and a sagemaker.runtime interface endpoint for keeping client traffic off the public internet. The template sits alongside the endpoint template in examples/sagemaker-marketplace/cloudformation, though it deploys to a different account — Identity Center management or delegated admin, in the Identity Center region, not the endpoint account. The companion updates to docs/self-hosted-sagemaker.md are held back to land with the CloudFormation/CDK restructure in PRD-435, so this page is not yet linked from the main guide. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01QMuenzrkUj9uZ3kwVjLiwT
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Adds a federated path to
sagemaker:InvokeEndpointfor orgs whose users come from Entra ID, Okta or another IdP, as an alternative to the long-lived access key thatscripts/create-sagemaker-invoke-user.tscreates. No IAM users, no static keys.What's here
docs/self-hosted-sagemaker-identity-center.md— platform-team setup (MiruInvokepermission set, group assignment, provisioning check) by console or CloudFormation; per-developeraws configure sso; what SSO session expiry looks like from Miru and its MCP server; OIDC roles for CI; asagemaker.runtimeinterface endpoint for keeping client traffic off the public internet.examples/sagemaker-marketplace/cloudformation/miru-identity-center.yml— permission set, inline policy and group assignment in one stack.Docs and a template only — no source changes.
Two things worth a reviewer's attention
This page is not yet linked from the main guide. The companion edits to
docs/self-hosted-sagemaker.md(splitting step 2 into Identity Center vs IAM user, plus deploy-wizard notes) are deliberately held back, because @kevalkapdee'sfeature/prd-435-update-sagemaker-setup-docsrestructures that same file around the CloudFormation/CDK templates. Landing both would conflict on step numbering. Those edits are ready and will be folded into PRD-435 rather than merged here, which is when the inbound link appears.The template deploys to a different account than its neighbour. It sits beside
sagemaker-marketplace-endpoint.yml, but that one goes to the workload account holding the endpoint, while this goes to the Identity Center management or delegated-admin account, in the Identity Center region. Called out in the doc, but the co-location does invite the assumption they're one stack run — happy to move it toexamples/identity-center/if that reads better.Checks
--parameter-overridesin the doc (PermissionSetNameandSessionDurationomitted, both have defaults).package.jsonandparseSetupCliArgs.🤖 Generated with Claude Code
https://claude.ai/code/session_01QMuenzrkUj9uZ3kwVjLiwT