Back to Checks
aws

SageMaker domains use SSO authentication instead of IAM mode

sagemaker_domain_sso_configured
Service: sagemakerSeverity: medium
OfficialBuilt-inVerified
Categories:identity-accessgen-ai
Resource Type:Other

SageMaker Domain configured with IAM Identity Center (SSO) authentication. The check validates that each SageMaker Domain uses SSO mode (AuthMode: SSO) and is associated with an IAM Identity Center instance (SingleSignOnManagedApplicationInstanceId or SingleSignOnApplicationArn present), ensuring user access is centrally managed through AWS IAM Identity Center.

Prowler logoProwlerprowler-provider-aws

Risk

IAM-mode domains create per-user IAM users or roles managed locally to SageMaker, drifting from the organization's identity provider and weakening lifecycle controls such as offboarding, MFA enforcement, and session policies. SSO-mode domains without an IAM Identity Center association leave authentication in an inconsistent state and bypass centralized access governance.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler aws --checks sagemaker_domain_sso_configured

Recommendation

Configure SageMaker Domains with SSO authentication mode to anchor user access to AWS IAM Identity Center. This enforces centralized identity lifecycle management, MFA policies, and session controls. Domains created with IAM mode must be recreated with SSO mode since the auth mode cannot be changed after creation.

Remediation

CLI

aws sagemaker describe-domain --domain-id <domain_id> --query '{AuthMode:AuthMode,SingleSignOnManagedApplicationInstanceId:SingleSignOnManagedApplicationInstanceId,SingleSignOnApplicationArn:SingleSignOnApplicationArn}'

Terraform

# Terraform: Create a SageMaker Domain with SSO authentication
resource "aws_sagemaker_domain" "example" {
  domain_name = "<example_domain_name>"
  auth_mode   = "SSO"  # Critical: enables IAM Identity Center authentication
  vpc_id      = "<example_vpc_id>"
  subnet_ids  = ["<example_subnet_id>"]

  default_user_settings {
    execution_role = "<example_role_arn>"
  }
}

NativeIaC

# CloudFormation: Create a SageMaker Domain with SSO authentication
Resources:
  SageMakerDomain:
    Type: AWS::SageMaker::Domain
    Properties:
      DomainName: <example_domain_name>
      AuthMode: SSO  # Critical: enables IAM Identity Center authentication
      DefaultUserSettings:
        ExecutionRole: <example_role_arn>
      VpcId: <example_vpc_id>
      SubnetIds:
        - <example_subnet_id>

Other

1SageMaker Domains cannot be switched from IAM to SSO mode after creation. To remediate, create a new Domain with AuthMode set to SSO and migrate user profiles.

Check Code

from prowler.lib.check.models import Check, Check_Report_AWS
from prowler.providers.aws.services.sagemaker.sagemaker_client import sagemaker_client


class sagemaker_domain_sso_configured(Check):
    def execute(self):
        findings = []
        for domain in sagemaker_client.sagemaker_domains:
            report = Check_Report_AWS(metadata=self.metadata(), resource=domain)
            if domain.auth_mode == "SSO":
                if (
                    domain.single_sign_on_managed_application_instance_id
                    or domain.single_sign_on_application_arn
                ):
                    report.status = "PASS"
                    report.status_extended = f"SageMaker domain {domain.name} is configured with SSO authentication and is associated with an IAM Identity Center instance."
                else:
                    report.status = "FAIL"
                    report.status_extended = f"SageMaker domain {domain.name} is configured with SSO authentication but is not associated with an IAM Identity Center instance."
            else:
                report.status = "FAIL"
                current_mode = domain.auth_mode if domain.auth_mode else "unknown"
                report.status_extended = f"SageMaker domain {domain.name} is not configured with SSO authentication, current mode is {current_mode}."

            findings.append(report)

        return findings

References