Cloud Native Operations

English

한국어

English

한국어

Appearance

Part 4: Domain, Project and Membership Governance ​

Documentation reviewed: 2026-09-12. Qwen provisioning results are historical; current account state was not rechecked.

The third recorded Qwen provisioning attempt reports a created project followed by read/delete denial because of caller membership. Training did not start. Do not generalize that record to every domain's current state or to every authorization failure.

1. Distinguish objects and identities ​

Object/roleMeaning
Unified domain / domain unitGovernance boundary and organizational hierarchy
Project profile / blueprintTool/environment provisioning and allowed accounts/regions
ProjectCollaboration, tools and shared resources
User/group profileService representation of SSO identities or registered IAM roles
Membership designationProject-level roles such as PROJECT_OWNER and PROJECT_CONTRIBUTOR
Project execution roleIdentity accessing AWS data/compute for the project
Catalog assetGoverned metadata such as descriptions, schemas and locations

First identify IAM-based versus Identity Center-based configuration and login. Member and execution roles have different purposes, even when their ARN is the same. IAM-based project members share data/compute access through the project execution role; owner designation does not automatically isolate per-user data permissions. Verify identity-based authorization/Trusted Identity Propagation separately when used.

AWS user-management documentation distinguishes the group profile of a registered IAM role from the session user profile created for someone logging in through it. Membership can use the role group profile. CreateGroupProfile with rolePrincipalARN registers a profile; it does not create the IAM role itself. Automatic treatment of a project's execution role is not necessarily the same as authorization of the automation caller.

2. A profile name does not prove tool readiness ​

All capabilities names a template of blueprints. Profiles can provision a blueprint at project creation or make it available later on demand. Check required services, accounts, regions, networks and permission to use the profile.

Select the intended profile ID/configuration rather than blindly choosing the first name match. A smaller capability set may suit the Qwen experiment, subject to organizational approval and real dependencies. Distinguish this workflow from ordinary SageMaker/EKS training paths without Unified Studio projects.

3. IAM, membership and data authorization ​

An allowed IAM action does not supply project ownership. Project ownership also does not bypass IAM, SCP, resource-policy or data-permission restrictions. An ordinary member/contributor is not automatically authorized to delete. Verify the project-owner or administrative authority required by the deletion path.

The current CreateProject API accepts membershipAssignments. This is a request-structure example: replace domain/profile/group identifiers with actual values resolved under authorized access.

json
{
  "domainIdentifier": "dzd-1111111111111111",
  "name": "docs-governance-example",
  "projectProfileId": "c1111111111111",
  "membershipAssignments": [
    {
      "member": {
        "groupIdentifier": "11111111-1111-1111-1111-111111111111"
      },
      "designation": "PROJECT_OWNER"
    }
  ]
}

member is a tagged union: set only one of groupIdentifier or userIdentifier. Including membership in the same request reduces the gap of a separate follow-up request, but does not promise transactional rollback of all project/environment provisioning. Read back the project and membership. After a timeout, reconcile the original request and inventory rather than repeatedly creating projects by name.

4. Project and tool readiness sequence ​

  1. Verify the intended account/region, domain type and profile ID.
  2. Distinguish caller login/profile, required owner/admin authority and execution-role permissions.
  3. Identify on-create versus on-demand blueprints and prepare approved dependencies.
  4. Store and read back CreateProject and membership results.
  5. Check projectStatus separately from environmentDeploymentDetails.
  6. Verify required environment/tool readiness and real read/write access before the next compute step.

projectStatus=ACTIVE does not mean every environment/tool is ready. overallDeploymentStatus includes PENDING_DEPLOYMENT, IN_PROGRESS, SUCCESSFUL, FAILED_VALIDATION and FAILED_DEPLOYMENT. Do not treat intentionally unprovisioned on-demand tools as failures; verify what this workload actually requires.

5. Tag failures and catalog disclosure ​

The current API supports resourceTags. The old experiment's rejection was a domain/request-specific observation, not proof that Unified Studio has no tag support. Inspect actual policy, values and errors. Limit compensation to resources created by this run and authorized for cleanup; a prefix is not sufficient reason to delete shared buckets or roles.

Public documentation can include necessary experiment counts, synthetic-data schema/record counts, generator version/seed/hash and ownership/retention principles. Keep actual PII, credentials, presigned URLs and reidentification mappings out of public artifacts.

An access-controlled internal catalog may need storage locations and resource identifiers for discovery/access. Public-document redaction is not a blanket ban on internal location metadata. Metadata publication, subscription approval and actual data authorization are separate steps.

6. Deletion and absence verification ​

  1. Identify data to retain and this run's owned resources/dependencies.
  2. Use authorized owner/admin context to stop the project's work and establish cleanup scope.
  3. Delete according to project, environment and managed-resource lifecycle.
  4. Inspect DELETING/DELETE_FAILED states/errors and verify completion.
  5. Reconcile remaining external Apps, S3, IAM and compute with inventory across relevant accounts/regions.

GetProject AccessDenied is not evidence of absence. An empty ListProjects response is also insufficient when visibility, filters or pagination restrict it. Verify domain/identity and every page, combining authorized get/list evidence with external-resource inventory. Project deletion does not guarantee removal of every external service resource; verify ownership and retention separately.

7. Historical scope of the Qwen validation ​

The stored validation JSON is dated 2026-09-01. It records trainingStarted=false for all three attempts, one remaining project after the third, and cleanup of experiment App/S3/IAM resources. September 2 documentation reports an ACTIVE recheck at that time. This review compares those records with current public API documentation; it does not establish whether the project exists or has been deleted in the current account.

Before resuming, verify current inventory and ownership. No project, membership, IAM or GPU resource was created/deleted during this review. The request example passed local AWS CLI output-skeleton input validation; the variant setting both member identity types was rejected by ParameterValidation. This does not demonstrate live authorization or environment provisioning success.

References ​

Previous: SageMaker AI / MLflow

Next: Validation results

Quiz