How do I check which role is used by my Amazon SageMaker Studio user? How do I change this role?
"I want to know which role is being used by Amazon SageMaker Studio user. Then, I want to change this role."
"I want to know which role is being used by Amazon SageMaker Studio user. Then, I want to change this role.ResolutionWhen you create and access a SageMaker Studio domain, you use the following AWS Identity and Access Management (IAM) roles:SageMaker Studio domain execution role: You use this role to set up and provision your studio infrastructure after accessing Studio integrated development environment (IDE) through the presigned URL.SageMaker user profile role: The permission scope of this role defines the actions that a user profile can perform within the Studio environment. This is the execution role that's assumed by SageMaker to create resources on your behalf within Studio.When you create a SageMaker Studio domain, then by default SageMaker allows you to create the execution role. This role has the AmazonSageMakerFullAccess policy attached to the role. This policy gives an extended access to user profile. If your use case requires that you manage these permissions, you can restrict access to user profiles by changing the SageMaker user profile role.To check the role that's attached to the user profile, run the following on a Jupyter notebook that was created by the user profile:import sagemakersagemaker_session = sagemaker.Session()#Check which role is being usedrole = sagemaker.get_execution_role()print(role)To change the role that's attached to a user profile, run the UpdateUserProfile command.You can update the role that's attached to an existing user profile by running the following AWS Command Line Interface (AWS CLI) command:aws sagemaker update-user-profile --example-domain-id --example-user-profile-name --user-settings ExecutionRole=arn:aws:iam::1111222233334444:role/service-role/example_sagemaker_execution_roleImportant: Before changing the IAM role for a SageMaker Studio user profile, be sure that your user doesn't have any 'InService' Apps active.Note: If you receive errors when running AWS CLI commands, make sure that you’re using the most recent version of the AWS CLI.Related informationSageMaker rolesFollow"