Migrate the UI from Studio Classic to Studio

1. Get the domain ID of your existing domain.

   1. Open the Amazon SageMaker AI console at https://console.aws.amazon.com/sagemaker/.

   2. From the left navigation pane, expand Admin configurations and choose Domains.

   3. Choose the existing domain.

   4. On the Domain details page, choose the Domain settings tab.

   5. Copy the Domain ID.

2. Add the domain ID of your existing domain.

   export REF_DOMAIN_ID="domain-id"
   export SM_REGION="region"

3. Use describe-domain to get important information about the existing domain.

   export REF_EXECROLE=$(aws sagemaker describe-domain --region=$SM_REGION --domain-id=$REF_DOMAIN_ID | jq -r '.DefaultUserSettings.ExecutionRole')
   export REF_VPC=$(aws sagemaker describe-domain --region=$SM_REGION --domain-id=$REF_DOMAIN_ID | jq -r '.VpcId')
   export REF_SIDS=$(aws sagemaker describe-domain --region=$SM_REGION --domain-id=$REF_DOMAIN_ID | jq -r '.SubnetIds | join(",")')
   export REF_SGS=$(aws sagemaker describe-domain --region=$SM_REGION --domain-id=$REF_DOMAIN_ID | jq -r '.DefaultUserSettings.SecurityGroups | join(",")')
   export AUTHMODE=$(aws sagemaker describe-domain --region=$SM_REGION --domain-id=$REF_DOMAIN_ID | jq -r '.AuthMode')

4. Validate the parameters.

   echo "Execution Role: $REF_EXECROLE || VPCID: $REF_VPC || SubnetIDs: $REF_SIDS || Security GroupIDs: $REF_SGS || AuthMode: $AUTHMODE"

5. Create a test domain using the configurations from the existing domain.

   IFS=',' read -r -a subnet_ids <<< "$REF_SIDS"
   IFS=',' read -r -a security_groups <<< "$REF_SGS"
   security_groups_json=$(printf '%s\n' "${security_groups[@]}" | jq -R . | jq -s .)
   
   aws sagemaker create-domain \
   --domain-name "TestV2Config" \
   --vpc-id $REF_VPC \
   --auth-mode $AUTHMODE \
   --subnet-ids "${subnet_ids[@]}" \
   --app-network-access-type VpcOnly \
   --default-user-settings "
   {
       \"ExecutionRole\": \"$REF_EXECROLE\",
       \"StudioWebPortal\": \"ENABLED\",
       \"DefaultLandingUri\": \"studio::\",
       \"SecurityGroups\": $security_groups_json
   }
   "

6. After the test domain is In Service, use the test domain's ID to create a user profile. This user profile is used to launch and test applications.

   aws sagemaker create-user-profile \
   --region="$SM_REGION" --domain-id=test-domain-id \
   --user-profile-name test-network-user

1. Add the test domain's ID.

   export TEST_DOMAIN="test-domain-id"
   export SM_REGION="region"

2. List all applications in the domain that are in a running state.

   active_apps_json=$(aws sagemaker list-apps --region=$SM_REGION --domain-id=$TEST_DOMAIN)
   echo $active_apps_json

3. Parse the JSON list of running applications and delete them. If users attempted to create an application that they do not have permissions for, there may be spaces that are not captured in the following script. You must manually delete these spaces.

   echo "$active_apps_json" | jq -c '.Apps[]' | while read -r app;
   do
       if echo "$app" | jq -e '. | has("SpaceName")' > /dev/null;
       then
           app_type=$(echo "$app" | jq -r '.AppType')
           app_name=$(echo "$app" | jq -r '.AppName')
           domain_id=$(echo "$app" | jq -r '.DomainId')
           space_name=$(echo "$app" | jq -r '.SpaceName')
   
           echo "Deleting App - AppType: $app_type || AppName: $app_name || DomainId: $domain_id || SpaceName: $space_name"
           aws sagemaker delete-app --region=$SM_REGION --domain-id=$domain_id \
           --app-type $app_type --app-name $app_name --space-name $space_name
   
           echo "Deleting Space - AppType: $app_type || AppName: $app_name || DomainId: $domain_id || SpaceName: $space_name"
           aws sagemaker delete-space --region=$SM_REGION --domain-id=$domain_id \
           --space-name $space_name
       else
   
           app_type=$(echo "$app" | jq -r '.AppType')
           app_name=$(echo "$app" | jq -r '.AppName')
           domain_id=$(echo "$app" | jq -r '.DomainId')
           user_profile_name=$(echo "$app" | jq -r '.UserProfileName')
   
           echo "Deleting Studio Classic - AppType: $app_type || AppName: $app_name || DomainId: $domain_id || UserProfileName: $user_profile_name"
           aws sagemaker delete-app --region=$SM_REGION --domain-id=$domain_id \
           --app-type $app_type --app-name $app_name --user-profile-name $user_profile_name
   
       fi
   
   done

4. Delete the test user profile.

   aws sagemaker delete-user-profile \
   --region=$SM_REGION --domain-id=$TEST_DOMAIN \
   --user-profile-name "test-network-user"

5. Delete the test domain.

   aws sagemaker delete-domain \
   --region=$SM_REGION --domain-id=$TEST_DOMAIN

1. Open the Amazon SageMaker AI console at https://console.aws.amazon.com/sagemaker/.

2. From the left navigation pane expand Admin configurations and choose Domains.

3. Choose the existing domain that you want to enable Studio as the default experience for.

4. On the Domain details page expand Enable the new Studio.

5. (Optional) To view the details about the steps involved in enabling Studio as your default experience, choose View details. The page shows the following.

   • In the SageMaker Studio Overview section you can view the applications that are included or available in the Studio web-based interface.

   • In the Enablement process section you can view descriptions of the workflow tasks to enable Studio.

     Note

     You will need to migrate your data manually. For instructions about migrating your data, see (Optional) Migrate data from Studio Classic to Studio.

   • In the Revert to Studio Classic experience section you can view how to revert back to Studio Classic after enabling Studio as your default experience.

6. To begin the process to enable Studio as your default experience, choose Enable the new Studio.

7. In the Specify and configure role section, you can view the default applications that are automatically included in Studio.

   To prevent users from running these applications, choose the AWS Identity and Access Management (IAM) Role that has an IAM policy that denies access. For information about how to create a policy to limit access, see Step 1: Update application creation permissions.

8. In the Choose default S3 bucket to attach CORS policy section, you can give Studio access to Amazon S3 buckets. The default Amazon S3 bucket, in this case, is the default Amazon S3 bucket for your Studio Classic. In this step you can do the following:

   • Verify the domain’s default Amazon S3 bucket to attach the CORS policy to. If your domain does not have a default Amazon S3 bucket, SageMaker AI creates an Amazon S3 bucket with the correct CORS policy attached.

   • You can include 10 additional Amazon S3 buckets to attach the CORS policy to.

     If you wish to include more than 10 buckets, you can add them manually. For more information about manually attaching the CORS policy to your Amazon S3 buckets, see (Optional) Update your CORS policy to access Amazon S3 buckets.

   To proceed, select the check box next to Do you agree to overriding any existing CORS policy on the chosen Amazon S3 buckets?.

9. The Migrate data section contains information about the different data storage volumes for Studio Classic and Studio. Your data will not be migrated automatically through this process. For instructions about migrating your data, lifecycle configurations, and JupyterLab extensions, see (Optional) Migrate data from Studio Classic to Studio.

10. Once you have completed the tasks on the page and verified your configuration, choose Enable the new Studio.

To add a CORS configuration to an Amazon S3 bucket

1. Verify that there is an Amazon S3 bucket in the same AWS Region as the existing domain with the following name. For instructions, see Viewing the properties for an Amazon S3 bucket.

   sagemaker-region-account-id

2. Add a CORS configuration with the following content to the default Amazon S3 bucket. For instructions, see Configuring cross-origin resource sharing (CORS).

   [
       {
           "AllowedHeaders": [
               "*"
           ],
           "AllowedMethods": [
               "POST",
               "PUT",
               "GET",
               "HEAD",
               "DELETE"
           ],
           "AllowedOrigins": [
               "https://*.sagemaker.aws"
           ],
           "ExposeHeaders": [
               "ETag",
               "x-amz-delete-marker",
               "x-amz-id-2",
               "x-amz-request-id",
               "x-amz-server-side-encryption",
               "x-amz-version-id"
           ]
       }
   ]

To grant permissions for Data Wrangler functionality inside Canvas

1. Attach the AWS managed policy AmazonSageMakerFullAccess to your user’s IAM role. For a procedure that shows you how to attach IAM policies to a role, see Adding IAM identity permissions (console) in the AWS IAM User Guide.

   If this permissions policy is too permissive for your use case, you can create scoped-down policies that include at least the following permissions:

   {
       "Sid": "AllowStudioActions",
       "Effect": "Allow",
       "Action": [
           "sagemaker:CreatePresignedDomainUrl",
           "sagemaker:DescribeDomain",
           "sagemaker:ListDomains",
           "sagemaker:DescribeUserProfile",
           "sagemaker:ListUserProfiles",
           "sagemaker:DescribeSpace",
           "sagemaker:ListSpaces",
           "sagemaker:DescribeApp",
           "sagemaker:ListApps"
       ],
       "Resource": "*"
   },
   {
       "Sid": "AllowAppActionsForUserProfile",
       "Effect": "Allow",
       "Action": [
           "sagemaker:CreateApp",
           "sagemaker:DeleteApp"
       ],
       "Resource": "arn:aws:sagemaker:region:account-id:app/domain-id/user-profile-name/canvas/*",
       "Condition": {
           "Null": {
               "sagemaker:OwnerUserProfileArn": "true"
           }
       }
   }

2. Attach the AWS managed policy AmazonSageMakerCanvasDataPrepFullAccess to your user’s IAM role.

To attach IAM policies to an execution role

1. Find the execution role attached to your SageMaker AI user profile

   1. In the SageMaker AI console https://console.aws.amazon.com/sagemaker/, navigate to Domains, then choose your SageMaker AI domain.

   2. The execution role ARN is listed under Execution role on the User Details page of your user profile. Make note of the execution role name in the ARN.

   3. In the IAM console https://console.aws.amazon.com/iam/, choose Roles.

   4. Search for your role by name in the search field.

   5. Select the role.

2. Add policies to the role

   1. In the IAM console https://console.aws.amazon.com/iam/, choose Roles.

   2. Search for your role by name in the search field.

   3. Select the role.

   4. In the Permissions tab, navigate to the dropdown menu Add permissions.

   5. • For managed policies: Select Attach policies, search for the name of the manage policy you want to attach.

        Select the policy then choose Add permissions.

      • For inline policies: Select Create inline policy, paste your policy in the JSON tab, choose next, name your policy, and choose Create.

1. Open the Amazon SageMaker AI console at https://console.aws.amazon.com/sagemaker/.

2. From the left navigation pane expand Admin configurations and choose Domains.

3. Choose the existing domain to revert.

4. Choose the Domain settings tab.

5. On the Domain details page, navigate to the Revert to Studio Classic experience section.

6. In the Revert to Studio Classic experience section choose Revert to Studio Classic process. This will take you to the Revert domain to Studio Classic page.

7. On the Revert domain to Studio Classic page, complete the following tasks and select the corresponding boxes. Go through the following tasks before reverting the existing domain's default experience to Studio Classic:

   1. Step 1 - Back up your data contains information about the different data storage volumes for Studio Classic and Studio. Your data will not be migrated automatically through this process. For instructions about migrating your data, lifecycle configurations, and JupyterLab extensions, see (Optional) Migrate data from Studio Classic to Studio.

   2. Delete all JupyterLab and Code Editor applications from Studio reminds you to delete your Studio applications to avoid additional charge. This is not a mandatory step because you can delete your applications and spaces after reverting the existing domain to Studio Classic. We recommend that you delete your unused applications and spaces to avoid additional costs from them.

      For instructions on how to delete applications and spaces from your domain, see Stop and delete your Studio running applications and spaces.

   3. Step 3 - Confirm you want to revert this domain to Studio Classic asks you to confirm your intention to revert the existing domain's default experience to Studio Classic.

   4. Provide feedback provides the option to leave feedback on the reason you are reverting the existing domain to Studio Classic.

8. Once all of the steps have been completed and the check boxes are filled, the Revert domain to Studio Classic button becomes available.

9. After you complete the tasks on the page and verify your changes, choose Revert domain to Studio Classic to revert the existing domain.