View a markdown version of this page

Analyze Amazon SageMaker Unified Studio data with external analytics applications through ODBC connection - Amazon SageMaker Unified Studio
Authentication modesConnection string parametersRedeemAccessToken API Reference

Analyze Amazon SageMaker Unified Studio data with external analytics applications through ODBC connection

Amazon SageMaker Unified Studio enables data consumers to easily locate and subscribe to data from multiple sources within a single project and analyze this data using Amazon Athena, Amazon Redshift Query Editor, and Amazon SageMaker.

Amazon SageMaker Unified Studio also supports authentication through the Athena ODBC driver that enables users to query their subscribed Amazon SageMaker Unified Studio data using popular external SQL and analytics tools, such as Microsoft Power BI, DBeaver, Microsoft Excel, pyodbc, isql, and many others. Users can authenticate using their corporate credentials through SSO or IAM and begin analyzing their subscribed data within their Amazon SageMaker Unified Studio projects.

Amazon SageMaker Unified Studio's support of the Athena ODBC driver provides the following benefits:

  • Greater tool choice for querying and visualization - data consumers can connect to Amazon SageMaker Unified Studio using their preferred tools from a wide range of analytics tools that support an ODBC connection. This enables them to continue using the software they are familiar with without the need to learn new tools for data consumption.

  • Programmatic access - an ODBC connection to access-governed data through servers or custom applications enables data consumers to perform automated and more complex data operations.

You can use your ODBC connection details to connect your external analytics tools to your Amazon SageMaker Unified Studio subscribed data. You can either copy a complete ODBC connection string for a DSN-less connection, or copy the individual parameters to configure a data source name (DSN). To obtain your ODBC connection details, perform the following procedure:

Important

In the current release, Amazon SageMaker Unified Studio supports authentication using the Amazon Athena ODBC driver, version 2.2.0.1 or later. To complete this procedure, make sure that you have downloaded and installed the latest Athena ODBC driver for your analytics application of choice.

  1. Navigate to Amazon SageMaker Unified Studio using the URL from your admin and log in using your SSO or AWS credentials.

  2. From the project selector dropdown at the top of the page, choose the project where you have the data that you want to analyze.

  3. In the Project overview, choose the JDBC and ODBC connections tab.

  4. In ODBC connection details, choose your authentication method (Using IDC auth or Using IAM auth) and then choose the icon next to the ODBC connection string to copy the string, or copy the individual parameters (domain ID, project ID, Athena workgroup, Region, and IAM Identity Center issuer URL). You can then use them to connect to your external analytics application.

When you connect your external analytics application to Amazon SageMaker Unified Studio using your ODBC connection string or parameters, you invoke the RedeemAccessToken API. The RedeemAccessToken API exchanges an Identity Center access token for the AmazonDataZoneDomainExecutionRole credentials, which are used to call the GetEnvironmentCredentials API.

For more information about the authentication mechanism that uses IAM credentials to connect to data governed by Amazon DataZone in Athena, see DataZone IAM Credentials Provider. For more information about the authentication mechanism that enables connecting to data governed by Amazon DataZone in Athena using IAM Identity Center, see DataZone Idc Credentials Provider.

Authentication modes

The Amazon Athena ODBC driver supports two authentication modes for Amazon SageMaker Unified Studio:

  • SageMakerBrowserIdc (for IDC-based domains) - the driver opens a browser window and authenticates through AWS IAM Identity Center (and your external identity provider, if configured). No local AWS credentials are needed.

  • SageMakerIam (for IAM-based and IDC-based domains) - the driver uses AWS credentials from the default credential provider chain.

Connection string parameters

When configuring a DSN-less connection or a named DSN, the Athena ODBC driver uses the following Amazon SageMaker Unified Studio parameters:

Amazon SageMaker Unified Studio ODBC connection string parameters
Parameter Connection string name Example
Authentication type AuthenticationType SageMakerBrowserIdc
SageMaker domain ID SageMakerDomainId dzd-123456example
SageMaker project ID SageMakerProjectId abcd12example
SageMaker domain Region SageMakerDomainRegion us-east-1
SSO OIDC start URL sso_oidc_start_url https://identitycenter.amazonaws.com/ssoins-0example
SSO OIDC Region sso_oidc_region us-east-1

RedeemAccessToken API Reference

Request syntax


POST /sso/redeem-token HTTP/1.1
Content-type: application/json

{
   "domainId": "string",
   "accessToken": "string"
}

Response syntax


HTTP/1.1 200
Content-type: application/json

{
   "credentials": AwsCredentials
}

Response elements

credentials

The AmazonDataZoneDomainExecutionRole credentials that are used to call the GetEnvironmentCredentials API.

Type: Array of AwsCredentials objects. This data type includes the following properties:

  • accessKeyId: AccessKeyId

  • secretAccessKey: SecretAccessKey

  • sessionToken: SessionToken

  • expiration: Timestamp