# Code Editor in Amazon SageMaker Studio
Code Editor, based on [Code-OSS, Visual Studio Code - Open Source](https://github.com/microsoft/vscode#visual-studio-code---open-source-code---oss), helps you write, test, debug, and run your analytics and machine learning code. Code Editor extends and is fully integrated with Amazon SageMaker Studio. It also supports integrated development environment (IDE) extensions available in the [Open VSX Registry](https://open-vsx.org/). The following page gives information about Code Editor and key details for using it.
Code Editor has the [AWS Toolkit for VS Code](https://docs.aws.amazon.com/toolkit-for-vscode/latest/userguide/welcome.html) extension pre-installed, which enables connections to AWS services such as [Amazon CodeWhisperer](https://docs.aws.amazon.com/toolkit-for-vscode/latest/userguide/codewhisperer.html), a general purpose, machine learning-powered code generator that provides code recommendations in real time. For more information about extensions, see [Code Editor Connections and Extensions](code-editor-use-connections-and-extensions.md).
**Important**
As of November 30, 2023, the previous Amazon SageMaker Studio experience is now named Amazon SageMaker Studio Classic. The following section is specific to using the updated Studio experience. For information about using the Studio Classic application, see [Amazon SageMaker Studio Classic](studio.md).
To launch Code Editor, create a Code Editor private space. The Code Editor space uses a single Amazon Elastic Compute Cloud (Amazon EC2) instance for your compute and a single Amazon Elastic Block Store (Amazon EBS) volume for your storage. Everything in your space such as your code, Git profile, and environment variables are stored on the same Amazon EBS volume. The volume has 3000 IOPS and a throughput of 125 MBps. Your administrator has configured the default Amazon EBS storage settings for your space.
The default storage size is 5 GB, but your administrator can increase the amount of space you get. For more information, see [Change the default storage size](code-editor-admin-storage-size.md).
The working directory of your users within the storage volume is `/home/sagemaker-user`. If you specify your own AWS KMS key to encrypt the volume, everything in the working directory is encrypted using your customer managed key. If you don't specify an AWS KMS key, the data inside `/home/sagemaker-user` is encrypted with an AWS managed key. Regardless of whether you specify an AWS KMS key, all of the data outside of the working directory is encrypted with an AWS Managed Key.
You can scale your compute up or down by changing the Amazon EC2 instance type that runs your Code Editor application. Before you change the associated instance type, you must first stop your Code Editor space. For more information, see [Code Editor application instances and images](code-editor-use-instances.md).
Your administrator might provide you with a lifecycle configuration to customize your environment. You can specify the lifecycle configuration when you create the space. For more information, see [Code Editor lifecycle configurations](code-editor-use-lifecycle-configurations.md).
You can also bring your own file storage system if you have an Amazon EFS volume.
![\[The welcome page of the Code Editor application UI.\]](http://docs.aws.amazon.com/sagemaker/latest/dg/images/code-editor/code-editor-home.png)
**Topics**
+ [Using the Code Editor](code-editor-use.md)
+ [Code Editor administrator guide](code-editor-admin.md)
# Using the Code Editor
The topics in this section provide guides for using Code Editor, including how to launch, add connections to AWS services, shut down resources, and more. After creating a Code Editor space, you can access your Code Editor session directly through the browser.
Within your Code Editor environment, you can do the following:
+ Access all artifacts persisted in your home directory
+ Clone your GitHub repositories and commit changes
+ Access the SageMaker Python SDK
You can return to Studio to review any assets created in your Code Editor environment such as experiments, pipelines, or training jobs.
**Topics**
+ [Check the version of Code Editor](code-editor-use-version.md)
+ [Code Editor application instances and images](code-editor-use-instances.md)
+ [Launch a Code Editor application in Studio](code-editor-use-studio.md)
+ [Launch a Code Editor application using the AWS CLI](code-editor-launch-cli.md)
+ [Clone a repository in Code Editor](code-editor-use-clone-a-repository.md)
+ [Code Editor Connections and Extensions](code-editor-use-connections-and-extensions.md)
+ [Shut down Code Editor resources](code-editor-use-log-out.md)
# Check the version of Code Editor
The following steps show how to check the version of your Code Editor application.
**To check the Code Editor application version**
1. Launch and run a Code Editor space and navigate to the Code Editor application UI. For more information, see [Launch a Code Editor application in Studio](code-editor-use-studio.md).
1. In the upper-left corner of the Code Editor UI, choose the menu button (![\[Hamburger menu icon with three horizontal lines.\]](http://docs.aws.amazon.com/sagemaker/latest/dg/images/code-editor/code-editor-menu-icon.png)). Then, choose **Help**. Then, choose **About**.
# Code Editor application instances and images
Only some instances are compatible with Code Editor applications. You can choose the instance type that is compatible with your use case from the **Instance** dropdown menu.
The **Fast launch** instances start up much faster than the other instances. For more information about fast launch instance types in Studio, [Instance Types Available for Use With Amazon SageMaker Studio Classic Notebooks](notebooks-available-instance-types.md).
**Note**
If you use a GPU instance type when configuring your Code Editor application, you must also use a GPU-based image. The Code Editor space UI automatically selects a compatible image when you select your instance type.
Within a space, your data is stored in an Amazon EBS volume that persists independently from the life of an instance. You won't lose your data when you change instances. If your Code Editor space is `Running`, you must stop your space before changing instance types.
The following table lists the ARNs of the available Code Editor CPU and GPU images for each Region.
| Region | CPU | GPU |
| --- | --- | --- |
| us-east-1 | arn:aws:sagemaker:us-east-1:885854791233:image/sagemaker-distribution-cpu | arn:aws:sagemaker:us-east-1:885854791233:image/sagemaker-distribution-gpu |
| us-east-2 | arn:aws:sagemaker:us-east-2:37914896644:image/sagemaker-distribution-cpu | arn:aws:sagemaker:us-east-2:37914896644:image/sagemaker-distribution-gpu |
| us-west-1 | arn:aws:sagemaker:us-west-1:053634841547:image/sagemaker-distribution-cpu | arn:aws:sagemaker:us-west-1:053634841547:image/sagemaker-distribution-gpu |
| us-west-2 | arn:aws:sagemaker:us-west-2:542918446943:image/sagemaker-distribution-cpu | arn:aws:sagemaker:us-west-2:542918446943:image/sagemaker-distribution-gpu |
| af-south-1 | arn:aws:sagemaker:af-south-1:238384257742:image/sagemaker-distribution-cpu | arn:aws:sagemaker:af-south-1:238384257742:image/sagemaker-distribution-gpu |
| ap-east-1 | arn:aws:sagemaker:ap-east-1:523751269255:image/sagemaker-distribution-cpu | arn:aws:sagemaker:ap-east-1:523751269255:image/sagemaker-distribution-gpu |
| ap-south-1 | arn:aws:sagemaker:ap-south-1:245090515133:image/sagemaker-distribution-cpu | arn:aws:sagemaker:ap-south-1:245090515133:image/sagemaker-distribution-gpu |
| ap-northeast-2 | arn:aws:sagemaker:ap-northeast-2:064688005998:image/sagemaker-distribution-cpu | arn:aws:sagemaker:ap-northeast-2:064688005998:image/sagemaker-distribution-gpu |
| ap-southeast-1 | arn:aws:sagemaker:ap-southeast-1:022667117163:image/sagemaker-distribution-cpu | arn:aws:sagemaker:ap-southeast-1:022667117163:image/sagemaker-distribution-gpu |
| ap-southeast-2 | arn:aws:sagemaker:ap-southeast-2:648430277019:image/sagemaker-distribution-cpu | arn:aws:sagemaker:ap-southeast-2:648430277019:image/sagemaker-distribution-gpu |
| ap-northeast-1 | arn:aws:sagemaker:ap-northeast-1:010972774902:image/sagemaker-distribution-cpu | arn:aws:sagemaker:ap-northeast-1:010972774902:image/sagemaker-distribution-gpu |
| ca-central-1 | arn:aws:sagemaker:ca-central-1:481561238223:image/sagemaker-distribution-cpu | arn:aws:sagemaker:ca-central-1:481561238223:image/sagemaker-distribution-gpu |
| eu-central-1 | arn:aws:sagemaker:eu-central-1:545423591354:image/sagemaker-distribution-cpu | arn:aws:sagemaker:eu-central-1:545423591354:image/sagemaker-distribution-gpu |
| eu-west-1 | arn:aws:sagemaker:eu-west-1:819792524951:image/sagemaker-distribution-cpu | arn:aws:sagemaker:eu-west-1:819792524951:image/sagemaker-distribution-gpu |
| eu-west-2 | arn:aws:sagemaker:eu-west-2:021081402939:image/sagemaker-distribution-cpu | arn:aws:sagemaker:eu-west-2:021081402939:image/sagemaker-distribution-gpu |
| eu-west-3 | arn:aws:sagemaker:eu-west-3:856416204555:image/sagemaker-distribution-cpu | arn:aws:sagemaker:eu-west-3:856416204555:image/sagemaker-distribution-gpu |
| eu-north-1 | arn:aws:sagemaker:eu-north-1:175620155138:image/sagemaker-distribution-cpu | arn:aws:sagemaker:eu-north-1:175620155138:image/sagemaker-distribution-gpu |
| eu-south-1 | arn:aws:sagemaker:eu-south-1:810671768855:image/sagemaker-distribution-cpu | arn:aws:sagemaker:eu-south-1:810671768855:image/sagemaker-distribution-gpu |
| sa-east-1 | arn:aws:sagemaker:sa-east-1:567556641782:image/sagemaker-distribution-cpu | arn:aws:sagemaker:sa-east-1:567556641782:image/sagemaker-distribution-gpu |
| ap-northeast-3 | arn:aws:sagemaker:ap-northeast-3:564864627153:image/sagemaker-distribution-cpu | arn:aws:sagemaker:ap-northeast-3:564864627153:image/sagemaker-distribution-gpu |
| ap-southeast-3 | arn:aws:sagemaker:ap-southeast-3:370607712162:image/sagemaker-distribution-cpu | arn:aws:sagemaker:ap-southeast-3:370607712162:image/sagemaker-distribution-gpu |
| me-south-1 | arn:aws:sagemaker:me-south-1:523774347010:image/sagemaker-distribution-cpu | arn:aws:sagemaker:me-south-1:523774347010:image/sagemaker-distribution-gpu |
| me-central-1 | arn:aws:sagemaker:me-central-1:358593528301:image/sagemaker-distribution-cpu | arn:aws:sagemaker:me-central-1:358593528301:image/sagemaker-distribution-gpu |
| il-central-1 | arn:aws:sagemaker:il-central-1:080319125002:image/sagemaker-distribution-cpu | arn:aws:sagemaker:il-central-1:080319125002:image/sagemaker-distribution-gpu |
| cn-north-1 | arn:aws:sagemaker:cn-north-1:674439102856:image/sagemaker-distribution-cpu | arn:aws:sagemaker:cn-north-1:674439102856:image/sagemaker-distribution-gpu |
| cn-northwest-1 | arn:aws:sagemaker:cn-northwest-1:651871951035:image/sagemaker-distribution-cpu | arn:aws:sagemaker:cn-northwest-1:651871951035:image/sagemaker-distribution-gpu |
| us-gov-west-1 | arn:aws:sagemaker:us-gov-west-1:300992924816:image/sagemaker-distribution-cpu | arn:aws:sagemaker:us-gov-west-1:300992924816:image/sagemaker-distribution-gpu |
| us-gov-east-1 | arn:aws:sagemaker:us-gov-east-1:300993876623:image/sagemaker-distribution-cpu | arn:aws:sagemaker:us-gov-east-1:300993876623:image/sagemaker-distribution-gpu |
If you encounter instance limits, contact your administrator. To get more storage and compute for a user, administrators can request an increase to a user's AWS quotas. For more information about requesting a quota increase, see [Amazon SageMaker AI endpoints and quotas](https://docs.aws.amazon.com/general/latest/gr/sagemaker.html).
# Launch a Code Editor application in Studio
To configure and access your Code Editor integrated development environment through Studio, you must create a Code Editor space. For more information about spaces in Studio, see [Amazon SageMaker Studio spaces](studio-updated-spaces.md).
![\[The Code Editor application button and overview tile in the Studio UI.\]](http://docs.aws.amazon.com/sagemaker/latest/dg/images/code-editor/code-editor-studio-home.png)
The following procedure shows how to create and run a Code Editor space.
**To create and run a Code Editor space**
1. Launch the updated Studio experience. For more information, see [Launch Amazon SageMaker Studio](https://docs.aws.amazon.com/sagemaker/latest/dg/studio-updated-launch.html).
1. Do one of the following:
+ Within the updated Amazon SageMaker Studio UI, select **Code Editor** from the **Applications** menu.
+ Within the updated Amazon SageMaker Studio UI, choose **View Code Editor spaces** in the **Overview** section of the Studio homepage.
1. In the upper-right corner of the Code Editor landing page, choose **Create Code Editor space**.
1. Enter a name for your Code Editor space. The name must be 1–62 characters in length using letters, numbers, and dashes only.
1. Choose **Create space**.
1. After the space is created, you have some options before you choose to run the space:
+ You can edit the **Storage (GB)**, **Lifecycle Configuration**, or **Attach custom EFS file system** settings. Options for these settings are available based on administrator specification.
+ From the **Instance** dropdown menu, you can choose the instance type most compatible with your use case. From the **Image** dropdown menu, you can choose a SageMaker Distribution image or a custom image provided by your administrator.
**Note**
Switching between sagemaker-distribution images changes the underlying version of Code Editor being used, which may cause incompatibilities due to browser caching. You should clear the browser cache when switching between images.
If you use a GPU instance type when configuring your Code Editor application, you must also use a GPU-based image. Within a space, your data is stored in an Amazon EBS volume that persists independently from the life of an instance. You won't lose your data when you change instances.
**Important**
Custom IAM policies that allow Studio users to create spaces must also grant permissions to list images (`sagemaker: ListImage`) to view custom images. To add the permission, see [ Add or remove identity permissions](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_manage-attach-detach.html) in the *AWS Identity and Access Management* User Guide.
[AWS managed policies for Amazon SageMaker AI](security-iam-awsmanpol.md) that give permissions to create SageMaker AI resources already include permissions to list images while creating those resources.
**Note**
To update space settings, you must first stop your space. If your Code Editor uses an instance with NVMe instance stores, any data stored on the NVMe store is deleted when the space is stopped.
1. After updating your settings, choose **Run Space** in the space detail page.
1. After the status of the space is `Running`, choose **Open Code Editor** to go to your Code Editor session.
![\[The space detail page for a Code Editor application in the Studio UI.\]](http://docs.aws.amazon.com/sagemaker/latest/dg/images/code-editor/code-editor-open.png)
# Launch a Code Editor application using the AWS CLI
To configure and access your Code Editor integrated development environment through the AWS Command Line Interface (AWS CLI), you must create a Code Editor space. Be sure to meet the [Complete prerequisites](code-editor-admin-prerequisites.md) before going through the following steps. Use the following procedure to create and run a Code Editor space.
**To create and run a Code Editor space**
1. Access a space using AWS Identity and Access Management (IAM) or AWS IAM Identity Center authentication. For more information about accessing spaces using the AWS CLI, see *Accessing spaces using the AWS Command Line Interface* in [Amazon SageMaker Studio spaces](studio-updated-spaces.md).
1. Create an application and specify `CodeEditor` as the `app-type` using the following command.
If you use a GPU instance type when creating your Code Editor application, you must also use a GPU-based image.
```
aws sagemaker create-app \
--domain-id domain-id \
--space-name space-name \
--app-type CodeEditor \
--app-name default \
--resource-spec "SageMakerImageArn=arn:aws:sagemaker:region:account-id:image/sagemaker-distribution-cpu"
```
For more information about available Code Editor image ARNs, see [Code Editor application instances and images](code-editor-use-instances.md).
1. After the Code Editor application is in service, launch the application using a presigned URL. You can use the `describe-app` API to check if your application is in service. Use the `create-presigned-domain-url` API to create a presigned URL:
```
aws sagemaker create-presigned-domain-url \
--domain-id domain-id \
--space-name space-name \
--user-profile-name user-profile-name \
--session-expiration-duration-in-seconds 43200 \
--landing-uri app:CodeEditor:
```
1. Open the generated URL to start working in your Code Editor application.
# Clone a repository in Code Editor
You can navigate through folders and clone a repository in the **Explorer** window of the Code Editor application UI.
To clone a repository, go through the following steps:
**To clone a repository**
1. Open your Code Editor application in the browser, and choose the **Exploration** button (![\[Icon representing multiple documents or pages stacked on top of each other.\]](http://docs.aws.amazon.com/sagemaker/latest/dg/images/code-editor/code-editor-exploration-icon.png)) in the left navigation pane.
1. Choose **Clone Repository** in the **Explorer** window. Then, provide a repository URL or pick a repository source in the prompt.
1. Choose a folder to clone your repository into. Note that the default Code Editor folder is `/home/sagemaker-user/`. Cloning your repository may take some time.
1. To open the cloned repository, choose either **Open in New Window** or **Open**.
1. To return to the Code Editor application UI homepage, choose **Cancel**.
1. Within the repository, a prompt asks if you trust the authors of the files in your new repository. You have two choices:
1. To trust the folder and enable all features, choose **Yes, I trust the authors**.
1. To browse the repository content in *restricted mode*, choose **No, I don't trust the authors**.
In restricted mode, tasks are not allowed to run, debugging is disabled, workspace settings are not applied, and extensions have limited functionality.
To exit restricted mode, trust the authors of all files in your current folder or its parent folder, and enable all features, choose **Manage** in the **Restricted Mode** banner.
# Code Editor Connections and Extensions
Code Editor supports IDE connections to AWS services as well as extensions available in the [Open VSX Registry](https://open-vsx.org/).
## Connections to AWS
Code Editor environments are integrated with the [AWS Toolkit for VS Code](https://docs.aws.amazon.com/toolkit-for-vscode/latest/userguide/welcome.html) to add connections to AWS services. To get started with connections to AWS services, you must have valid AWS Identity and Access Management (IAM) credentials. For more information, see [Authentication and access for the AWS Toolkit for Visual Studio Code](https://docs.aws.amazon.com/toolkit-for-vscode/latest/userguide/establish-credentials.html).
Within your Code Editor environment, you can add connections to:
+ [AWS Explorer ](https://docs.aws.amazon.com/toolkit-for-vscode/latest/userguide/aws-explorer.html) – View, modify, and deploy AWS resources in Amazon S3, CloudWatch, and more.
Accessing certain features within AWS Explorer requires certain AWS permissions. For more information, see [Authentication and access for the AWS Toolkit for Visual Studio Code](https://docs.aws.amazon.com/toolkit-for-vscode/latest/userguide/establish-credentials.html).
+ [Amazon CodeWhisperer](https://docs.aws.amazon.com/toolkit-for-vscode/latest/userguide/codewhisperer.html) – Build applications faster with AI-powered code suggestions.
To use Amazon CodeWhisperer with Code Editor, you must add the following permissions to your SageMaker AI execution role.
------
#### [ JSON ]
****
```
{
"Version":"2012-10-17",
"Statement": [
{
"Sid": "CodeWhispererPermissions",
"Effect": "Allow",
"Action": ["codewhisperer:GenerateRecommendations"],
"Resource": "*"
}
]
}
```
------
For more information, see [Creating IAM policies](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_create.html) and [Adding and removing IAM identity permissions](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_manage-attach-detach.html) in the *IAM User Guide*.
## Extensions
Code Editor supports IDE extensions available in the [Open VSX Registry](https://open-vsx.org/).
To get started with extensions in your Code Editor environment, choose the **Extensions** icon (![\[Icon showing two overlapping squares representing multiple windows or instances.\]](http://docs.aws.amazon.com/sagemaker/latest/dg/images/code-editor/code-editor-extensions-icon.png)) in the left navigation pane. Here, you can configure connections to AWS by installing the AWS Toolkit. For more information, see [Installing the AWS Toolkit for Visual Studio Code](https://docs.aws.amazon.com/toolkit-for-vscode/latest/userguide/setup-toolkit.html).
In the search bar, you can search directly for additional extensions through the [Open VSX Registry](https://open-vsx.org/), such as the AWS Toolkit, Jupyter, Python, and more.
# Shut down Code Editor resources
When you're finished using a Code Editor space, you can use Studio to stop it. That way, you stop incurring costs for the space.
Alternatively, you can delete unused Code Editor resources by using the AWS CLI.
## Stop your Code Editor space using Studio
To stop your Code Editor space in Studio use the following steps:
**To stop your Code Editor space in Studio**
1. Return to the Code Editor landing page by doing one of the following:
1. In the navigation bar in the upper-left corner, choose **Code Editor**.
1. Alternatively, in the left navigation pane, choose **Code Editor** in the **Applications** menu.
1. Find the name of the Code Editor space you created. If the status of your space is **Running**, choose **Stop** in the **Action** column. You can also stop your space directly in the space detail page by choosing **Stop space**. The space may take some time to stop.
![\[A space detail page in the Code Editor application UI.\]](http://docs.aws.amazon.com/sagemaker/latest/dg/images/code-editor/code-editor-stop-space.png)
Additional resources such as SageMaker AI endpoints, Amazon EMR (Amazon EMR) clusters and Amazon Simple Storage Service (Amazon S3) buckets created from Studio are not automatically deleted when your space instance shuts down. To stop accruing charges from resources, delete any additional resources. For more information, see [Delete unused resources](https://docs.aws.amazon.com/sagemaker/latest/dg/studio-updated-jl-admin-guide-clean-up.html).
## Delete Code Editor resources using the AWS CLI
You can delete your Code Editor application and space using the AWS Command Line Interface (AWS CLI).
+ [DeleteApp](https://docs.aws.amazon.com/sagemaker/latest/APIReference/API_DeleteApp.html)
+ [DeleteSpace](https://docs.aws.amazon.com/sagemaker/latest/APIReference/API_DeleteSpace.html)
# Code Editor administrator guide
You can use Code Editor with an On-Demand Instance for faster start-up time, and configurable storage. You can launch a Code Editor application through Amazon SageMaker Studio or through the AWS CLI. You can also edit Code Editor default settings within the domain console. For more information, see [Edit domain settings](domain-edit.md). The following topics outline how administrators can configure Code Editor, based on Code-OSS, Visual Studio Code - Open Source by changing storage options, customizing environments, and managing user access, as well as giving information about the prerequisites needed to use Code Editor.
**Topics**
+ [Complete prerequisites](code-editor-admin-prerequisites.md)
+ [Give your users access to private spaces](code-editor-admin-user-access.md)
+ [Change the default storage size](code-editor-admin-storage-size.md)
+ [Code Editor lifecycle configurations](code-editor-use-lifecycle-configurations.md)
+ [Custom images](code-editor-custom-images.md)
# Complete prerequisites
To use Code Editor, based on Code-OSS, Visual Studio Code - Open Source, you must complete the following prerequisites.
1. You must first onboard to Amazon SageMaker AI domain and create a user profile. For more information, see [Amazon SageMaker AI domain overview](gs-studio-onboard.md).
1. If you are interacting with your Code Editor application using the AWS CLI, you must also complete the following prerequisites.
1. Update the AWS CLI by following the steps in [Installing the current AWS CLI Version](https://docs.aws.amazon.com/cli/latest/userguide/install-cliv1.html#install-tool-bundled).
1. From your local machine, run `aws configure` and provide your AWS credentials. For information about AWS credentials, see [Understanding and getting your AWS credentials](https://docs.aws.amazon.com/general/latest/gr/aws-sec-cred-types.html).
1. (Optional) To get more storage and compute for your application, you can request an increase to your AWS quotas. For more information about requesting a quota increase, see [Amazon SageMaker AI endpoints and quotas](https://docs.aws.amazon.com/general/latest/gr/sagemaker.html).
# Give your users access to private spaces
**Important**
Custom IAM policies that allow Amazon SageMaker Studio or Amazon SageMaker Studio Classic to create Amazon SageMaker resources must also grant permissions to add tags to those resources. The permission to add tags to resources is required because Studio and Studio Classic automatically tag any resources they create. If an IAM policy allows Studio and Studio Classic to create resources but does not allow tagging, "AccessDenied" errors can occur when trying to create resources. For more information, see [Provide permissions for tagging SageMaker AI resources](security_iam_id-based-policy-examples.md#grant-tagging-permissions).
[AWS managed policies for Amazon SageMaker AI](security-iam-awsmanpol.md) that give permissions to create SageMaker resources already include permissions to add tags while creating those resources.
This section provides a policy that grants user access to private spaces. You can also use the policy to restrict private spaces and applications that are associated with them to the owner associated with the user profile.
You must provide your users with permissions to the following:
+ Private spaces
+ The user profile required for access to the private spaces
To provide permissions, attach the following policy to the IAM roles of your users.
------
#### [ JSON ]
****
```
{
"Version":"2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": [
"sagemaker:CreateApp",
"sagemaker:DeleteApp"
],
"Resource": "arn:aws:sagemaker:us-east-1:111122223333:app/*",
"Condition": {
"Null": {
"sagemaker:OwnerUserProfileArn": "true"
}
}
},
{
"Sid": "SMStudioCreatePresignedDomainUrlForUserProfile",
"Effect": "Allow",
"Action": [
"sagemaker:CreatePresignedDomainUrl"
],
"Resource": "arn:aws:sagemaker:us-east-1:111122223333:user-profile/domain-id/user-profile-name"
},
{
"Sid": "SMStudioAppPermissionsListAndDescribe",
"Effect": "Allow",
"Action": [
"sagemaker:ListApps",
"sagemaker:ListDomains",
"sagemaker:ListUserProfiles",
"sagemaker:ListSpaces",
"sagemaker:DescribeApp",
"sagemaker:DescribeDomain",
"sagemaker:DescribeUserProfile",
"sagemaker:DescribeSpace"
],
"Resource": "*"
},
{
"Sid": "SMStudioAppPermissionsTagOnCreate",
"Effect": "Allow",
"Action": [
"sagemaker:AddTags"
],
"Resource": "arn:aws:sagemaker:us-east-1:111122223333:*/*",
"Condition": {
"Null": {
"sagemaker:TaggingAction": "false"
}
}
},
{
"Sid": "SMStudioRestrictSharedSpacesWithoutOwners",
"Effect": "Allow",
"Action": [
"sagemaker:CreateSpace",
"sagemaker:UpdateSpace",
"sagemaker:DeleteSpace"
],
"Resource": "arn:aws:sagemaker:us-east-1:111122223333:space/domain-id/*",
"Condition": {
"Null": {
"sagemaker:OwnerUserProfileArn": "true"
}
}
},
{
"Sid": "SMStudioRestrictSpacesToOwnerUserProfile",
"Effect": "Allow",
"Action": [
"sagemaker:CreateSpace",
"sagemaker:UpdateSpace",
"sagemaker:DeleteSpace"
],
"Resource": "arn:aws:sagemaker:us-east-1:111122223333:space/domain-id/*",
"Condition": {
"ArnLike": {
"sagemaker:OwnerUserProfileArn": "arn:aws:sagemaker:us-east-1:111122223333:user-profile/domain-id/user-profile-name"
},
"StringEquals": {
"sagemaker:SpaceSharingType": [
"Private",
"Shared"
]
}
}
},
{
"Sid": "SMStudioRestrictCreatePrivateSpaceAppsToOwnerUserProfile",
"Effect": "Allow",
"Action": [
"sagemaker:CreateApp",
"sagemaker:DeleteApp"
],
"Resource": "arn:aws:sagemaker:us-east-1:111122223333:app/domain-id/*",
"Condition": {
"ArnLike": {
"sagemaker:OwnerUserProfileArn": "arn:aws:sagemaker:us-east-1:111122223333:user-profile/domain-id/user-profile-name"
},
"StringEquals": {
"sagemaker:SpaceSharingType": [
"Private"
]
}
}
}
]
}
```
------
# Change the default storage size
You can change the default storage settings of your users. You can also change the default storage settings based on your organizational requirements and the needs of your users.
To change the storage size of your users, do the following:
1. Update the Amazon EBS storage settings in the domain.
1. Create a user profile and specify the storage settings within it.
Use the following AWS Command Line Interface (AWS CLI) command to update the domain.
```
aws --region $REGION sagemaker update-domain \
--domain-id $DOMAIN_ID \
--default-user-settings '{
"SpaceStorageSettings": {
"DefaultEbsStorageSettings":{
"DefaultEbsVolumeSizeInGb":5,
"MaximumEbsVolumeSizeInGb":100
}
}
}'
```
Use the following AWS CLI command to create the user profile and specify the default storage settings.
```
aws --region $REGION sagemaker create-user-profile \
--domain-id $DOMAIN_ID \
--user-profile-name $USER_PROFILE_NAME \
--user-settings '{
"SpaceStorageSettings": {
"DefaultEbsStorageSettings":{
"DefaultEbsVolumeSizeInGb":5,
"MaximumEbsVolumeSizeInGb":100
}
}
}'
```
Use the following AWS CLI commands to update the default storage settings in the user profile.
```
aws --region $REGION sagemaker update-user-profile \
--domain-id $DOMAIN_ID \
--user-profile-name $USER_PROFILE_NAME \
--user-settings '{
"SpaceStorageSettings": {
"DefaultEbsStorageSettings":{
"DefaultEbsVolumeSizeInGb":25,
"MaximumEbsVolumeSizeInGb":200
}
}
}'
```
# Code Editor lifecycle configurations
You can use Code Editor lifecycle configurations to automate customization for your Studio environment. This customization includes installing custom packages, configuring extensions, preloading datasets, and setting up source code repositories
The following instructions use the AWS Command Line Interface (AWS CLI) to create, attach, debug, and detach lifecycle configurations for the `CodeEditor` application type:
+ [Create and attach lifecycle configurations in Studio](code-editor-use-lifecycle-configurations-studio-create.md)
+ [Debug lifecycle configurations in Studio](code-editor-use-lifecycle-configurations-studio-debug.md)
+ [Detach lifecycle configurations in Studio](code-editor-use-lifecycle-configurations-studio-detach.md)
# Create and attach lifecycle configurations in Studio
The following section provides AWS CLI commands to create a lifecycle configuration, attach a lifecycle configuration when creating a new user profile, and attach a lifecycle configuration when updating a user profile. For prerequisites and general steps on creating and attaching lifecycle configurations in Studio, see [Lifecycle configuration creation](jl-lcc-create.md).
When creating your Studio lifecycle configuration with the `create-studio-lifecycle-config` command, be sure to specify that the `studio-lifecycle-config-app-type` is `CodeEditor`. The following example shows how to create a new Studio lifecycle configuration for your Code Editor application.
```
aws sagemaker create-studio-lifecycle-config \
--studio-lifecycle-config-name my-code-editor-lcc \
--studio-lifecycle-config-content $LCC_CONTENT \
--studio-lifecycle-config-app-type CodeEditor
```
Note the ARN of the newly created lifecycle configuration that is returned. When attaching a lifecycle configuration, provide this ARN within the `LifecycleConfigArns` list of `CodeEditorAppSettings`.
You can attach a lifecycle configuration when creating a user profile or domain. The following example shows how to create a new user profile with the lifecycle configuration attached. You can also create a new domain with a lifecycle configuration attached by using the [create-domain](https://awscli.amazonaws.com/v2/documentation/api/latest/reference/opensearch/create-domain.html) command.
```
# Create a new UserProfile
aws sagemaker create-user-profile \
--domain-id domain-id \
--user-profile-name user-profile-name \
--user-settings '{
"CodeEditorAppSettings": {
"LifecycleConfigArns":
[lifecycle-configuration-arn-list]
}
}'
```
You can alternatively attach a lifecycle configuration when updating a user profile or domain. The following example shows how to update a user profile with the lifecycle configuration attached. You can also update a new domain with a lifecycle configuration attached by using the [update-domain](https://awscli.amazonaws.com/v2/documentation/api/latest/reference/sagemaker/update-domain.html) command.
```
# Update a UserProfile
aws sagemaker update-user-profile \
--domain-id domain-id \
--user-profile-name user-profile-name \
--user-settings '{
"CodeEditorAppSettings": {
"LifecycleConfigArns":
[lifecycle-configuration-arn-list]
}
}'
```
# Debug lifecycle configurations in Studio
To debug lifecycle configuration scripts for Code Editor, you must use Studio. For instructions about debugging lifecycle configurations in Studio, see [Debug lifecycle configurations](jl-lcc-debug.md). To find the logs for a specific application, search the log streams using the following format:
```
domain-id/space-name/CodeEditor/default/LifecycleConfigOnStart
```
# Detach lifecycle configurations in Studio
To detach lifecycle configurations for Code Editor, you can use either the console or the AWS CLI. For steps on detaching lifecycle configurations from the Studio console, see [Detach lifecycle configurations](jl-lcc-delete.md).
To detach a lifecycle configuration using the AWS CLI, remove the desired lifecycle configuration from the list of lifecycle configurations attached to the resource. Then pass the list as part of the respective command:
+ [update-user-profile](https://awscli.amazonaws.com/v2/documentation/api/latest/reference/sagemaker/update-user-profile.html)
+ [update-domain](https://awscli.amazonaws.com/v2/documentation/api/latest/reference/sagemaker/update-domain.html)
For example, the following command removes all lifecycle configurations for the Code Editor application attached to the domain.
```
aws sagemaker update-domain --domain-id domain-id \
--default-user-settings '{
"CodeEditorAppSettings": {
"LifecycleConfigArns":
[]
}
}'
```
# Create a lifecycle configuration to clone repositories into a Code Editor application
This section shows how to clone a repository and create a Code Editor application with the lifecycle configuration attached.
1. From your local machine, create a file named `my-script.sh` with the following content:
```
#!/bin/bash
set -eux
```
1. Clone the repository of your choice in your lifecycle configuration script.
```
export REPOSITORY_URL="https://github.com/aws-samples/sagemaker-studio-lifecycle-config-examples.git"
git -C /home/sagemaker-user clone $REPOSITORY_URL
```
1. After finalizing your script, create and attach your lifecycle configuration. For more information, see [Create and attach lifecycle configurations in Studio](code-editor-use-lifecycle-configurations-studio-create.md).
1. Create your Code Editor application with the lifecycle configuration attached.
```
aws sagemaker create-app \
--domain-id domain-id \
--space-name space-name \
--app-type CodeEditor \
--app-name default \
--resource-spec "SageMakerImageArn=arn:aws:sagemaker:region:image-account-id:image/sagemaker-distribution-cpu,LifecycleConfigArn=arn:aws:sagemaker:region:user-account-id:studio-lifecycle-config/my-code-editor-lcc,InstanceType=ml.t3.large"
```
For more information about available Code Editor image ARNs, see [Code Editor application instances and images](code-editor-use-instances.md).
# Create a lifecycle configuration to install Code Editor extensions
This section shows how to create a lifecycle configuration to install extensions from the [Open VSX Registry](https://open-vsx.org/) in your Code Editor environment.
1. From your local machine, create a file named `my-script.sh` with the following content:
```
#!/bin/bash
set -eux
```
1. Within the script, install the [Open VSX Registry](https://open-vsx.org/) extension of your choice:
```
sagemaker-code-editor --install-extension AmazonEMR.emr-tools --extensions-dir /opt/amazon/sagemaker/sagemaker-code-editor-server-data/extensions
```
You can retrieve the extension name from the URL of the extension in the [Open VSX Registry](https://open-vsx.org/). The extension name to use in the `sagemaker-code-editor` command should contain all text that follows `https://open-vsx.org/extension/` in the URL. Replace all instances of a slash (`/`) with a period (`.`). For example, `AmazonEMR/emr-tools` should be `AmazonEMR.emr-tools`.
![\[The Amazon EMR extension page in the Open VSX Registry.\]](http://docs.aws.amazon.com/sagemaker/latest/dg/images/code-editor/code-editor-emr-extension.png)
1. After finalizing your script, create and attach your lifecycle configuration. For more information, see [Create and attach lifecycle configurations in Studio](code-editor-use-lifecycle-configurations-studio-create.md).
1. Create your Code Editor application with the lifecycle configuration attached:
```
aws sagemaker create-app \
--domain-id domain-id \
--space-name space-name \
--app-type CodeEditor \
--app-name default \
--resource-spec "SageMakerImageArn=arn:aws:sagemaker:region:image-account-id:image/sagemaker-distribution-cpu,LifecycleConfigArn=arn:aws:sagemaker:region:user-account-id:studio-lifecycle-config/my-code-editor-lcc,InstanceType=ml.t3.large"
```
For more information about available Code Editor image ARNs, see [Code Editor application instances and images](code-editor-use-instances.md). For more information about connections and extensions, see [Code Editor Connections and Extensions](code-editor-use-connections-and-extensions.md).
# Custom images
If you need functionality that is different than what's provided by SageMaker distribution, you can bring your own image with your custom extensions and packages. You can also use it to personalize the Code Editor UI for your own branding or compliance needs.
The following page will provide Code Editor-specific information and templates to create your own custom SageMaker AI images. This is meant to supplement the Amazon SageMaker Studio information and instructions on creating your own SageMaker AI image and bringing your own image to Studio. To learn about custom Amazon SageMaker AI images and how to bring your own image to Studio, see [Bring your own image (BYOI)](studio-updated-byoi.md).
**Topics**
+ [Health check and URL for applications](#code-editor-custom-images-app-healthcheck)
+ [Dockerfile examples](#code-editor-custom-images-dockerfile-templates)
## Health check and URL for applications
+ `Base URL` – The base URL for the BYOI application must be `CodeEditor/default`. You can only have one application and it must always be named `default`.
+ Health check endpoint – You must host your Code Editor server at 0.0.0.0 port 8888 for SageMaker AI to detect it.
+ Authentication – You must pass `--without-connection-token` when opening `sagemaker-code-editor` to allow SageMaker AI to authenticate your users.
**Note**
If you are using Amazon SageMaker Distribution as the base image, these requirements are already taken care of as part of the included `entrypoint-code-editor` script.
## Dockerfile examples
The following examples are `Dockerfile`s that meets the above information and [Custom image specifications](studio-updated-byoi-specs.md).
**Note**
If you are bringing your own image to SageMaker Unified Studio, you will need to follow the [Dockerfile specifications](https://docs.aws.amazon.com/sagemaker-unified-studio/latest/userguide/byoi-specifications.html) in the *Amazon SageMaker Unified Studio User Guide*.
`Dockerfile` examples for SageMaker Unified Studio can be found in [Dockerfile example](https://docs.aws.amazon.com/sagemaker-unified-studio/latest/userguide/byoi-specifications.html#byoi-specifications-example) in the *Amazon SageMaker Unified Studio User Guide*.
------
#### [ Example micromamba Dockerfile ]
The following is an example Dockerfile to create an image from scratch using a [https://mamba.readthedocs.io/en/latest/user_guide/micromamba.html](https://mamba.readthedocs.io/en/latest/user_guide/micromamba.html) base environment:
```
FROM mambaorg/micromamba:latest
ARG NB_USER="sagemaker-user"
ARG NB_UID=1000
ARG NB_GID=100
USER root
RUN micromamba install -y --name base -c conda-forge sagemaker-code-editor
USER $NB_UID
CMD eval "$(micromamba shell hook --shell=bash)"; \
micromamba activate base; \
sagemaker-code-editor --host 0.0.0.0 --port 8888 \
--without-connection-token \
--base-path "/CodeEditor/default"
```
------
#### [ Example SageMaker AI Distribution Dockerfile ]
The following is an example Dockerfile to create an image based on [Amazon SageMaker AI Distribution](https://github.com/aws/sagemaker-distribution/tree/main):
```
FROM public.ecr.aws/sagemaker/sagemaker-distribution:latest-cpu
ARG NB_USER="sagemaker-user"
ARG NB_UID=1000
ARG NB_GID=100
ENV MAMBA_USER=$NB_USER
USER root
# install scrapy in the base environment
RUN micromamba install -y --name base -c conda-forge scrapy
# download VSCodeVim
RUN \
wget https://github.com/VSCodeVim/Vim/releases/download/v1.27.2/vim-1.27.2.vsix \
-P /tmp/exts/ --no-check-certificate
# Install the extension
RUN \
extensionloc=/opt/amazon/sagemaker/sagemaker-code-editor-server-data/extensions \
&& sagemaker-code-editor \
--install-extension "/tmp/exts/vim-1.27.2.vsix" \
--extensions-dir "${extensionloc}"
USER $MAMBA_USER
ENTRYPOINT ["entrypoint-code-editor"]
```
------