Build a multi-team AI and analytics environment on Amazon SageMaker Unified Studio with Terraform

Platform engineers who support data and AI teams face a recurring challenge: analytics, machine learning (ML), and AI developer teams each need different tools. When each team operates its own tools and infrastructure, governance becomes fragmented. Organizations face duplicated effort and limited collaboration. Data engineers, data scientists, and AI developers might all work with the same underlying data. Yet they navigate separate consoles, manage distinct AWS Identity and Access Management (IAM) configurations, and lack a shared view of each other’s work.

Amazon SageMaker Unified Studio brings these capabilities together in one governed workspace. Every practitioner gets access to the tools they need: SQL editors, JupyterLab notebooks, and the Amazon Bedrock IDE. At the same time, they share a common business data catalog, security model, and project structure, all governed centrally within Amazon SageMaker Unified Studio. Teams collaborate within projects, while access to data, compute, and development artifacts is managed centrally.

Setting up this kind of multi-team environment means coordinating IAM roles, blueprints, project profiles, and user onboarding on top of the initial domain configuration. New user roles and use cases might require enabling new blueprints and combining them into new project profiles to extend the functionality supported by the domain. To keep this repeatable and consistent, we use the Amazon SageMaker Unified Studio Terraform module to codify the entire setup. The module creates three purpose-built project profiles, one for each team, on a shared domain, plus an initial project to get you started. Creating the remaining per-team projects is a single additional sub-module block.

Consider a mid-size technology company with three teams that need cloud-based data and AI capabilities:

A common issue today is that customers don’t have a unified strategy to deploy and manage their infrastructure. The analytics team has a standalone Amazon Redshift cluster, the ML team provisions SageMaker notebooks ad hoc, and the generative AI team experiments with Bedrock through the console. Each team runs its own infrastructure. Because these environments are separate, there’s no shared data catalog, no consistent access control, and no central visibility into what’s running or what it costs.

The goal: a single unified environment where each team gets exactly the capabilities they need, with shared data access, consistent security, and infrastructure you define entirely as code.

Solution overview

We use the Amazon SageMaker Unified Studio Terraform module to create a single domain with three project profiles, one per team. A project profile is a collection of blueprints which are configurations used to create projects, while the domain provides shared governance, IAM roles, and networking.

Key module capabilities:

• Dual provider: Uses both the AWS provider and AWS Cloud Control (AWSCC) provider for full Amazon SageMaker Unified Studio resource coverage.
• Service role flexibility: All IAM roles are auto-created with least-privilege policies, or you can supply existing roles to be used by Amazon SageMaker Unified Studio.
• Domain and project level access using AWS Identity and Access Management (IAM), single sign-on (SSO) with AWS IAM Identity Center or both.
• KMS encryption: Optionally encrypt domain metadata with a customer-managed AWS Key Management Service (AWS KMS) key using kms_key_identifier.
• Model governance: The domain module automatically provisions a model governance project for Generative AI administrators to be added to. Members of the project can enable or disable specific models accessible in the domain.

Figure 1: Multi-team Amazon SageMaker Unified Studio architecture

The Terraform module follows a layered architecture with four composable modules:

Layer 1: Domain module. Creates the domain, Tooling blueprint, IAM roles, and S3 bucket:

module "domain" { source = "aws-ia/sagemaker-unified-studio/aws" domain_name = var.domain_name vpc_id = vpc-xxx subnet_ids = ["subnet-xxx", "subnet-yyy", "subnet-zzz"] enable_sso = var.enable_sso }

Layer 2: Blueprint module. Enables individual blueprints on the domain using for_each:

module "blueprints" { source = "aws-ia/sagemaker-unified-studio/aws//modules/blueprint" for_each = local.blueprint_configs domain_id = module.domain.domain_id blueprint_name = each.value.blueprint_name regional_parameters = local.regional_parameters manage_access_role_arn = module.domain.manage_access_role_arn provisioning_role_arn = module.domain.provisioning_role_arn }

Layer 3: Project profile module. Composes blueprints into team-specific profiles:

module "sql_analytics_project_profile" { source = "aws-ia/sagemaker-unified-studio/aws//modules/project-profile" domain_id = module.domain.domain_id name = "SQL analytics" blueprints = local.sql_analytics_blueprint_config blueprint_dependencies = [for k, bp in module.blueprints : bp.entity_id] depends_on = [module.blueprints] }

Layer 4: Project and Project membership module. Creates a project and assigns members:

module "project" { source = "aws-ia/sagemaker-unified-studio/aws//modules/project" domain_id = module.domain.domain_id project_name = local.project_name project_profile_id = concat(module.all_capabilities_project_profile, module.sql_analytics_project_profile, module.generative_ai_project_profile)[0].project_profile_id depends_on = [module.create_project_from_project_profile_grant] } module "project_membership" { source = " aws-ia/sagemaker-unified-studio/aws//modules/project-membership" domain_id = module.domain.domain_id project_id = module.project[0].project_id project_owners = var.project_owners project_contributors = var.project_contributors depends_on = [ aws_datazone_user_profile.sso_users, aws_datazone_user_profile.iam_users, awscc_datazone_group_profile.sso_groups, ] }

At a high level, the deployment mentioned in this post performs the following:

1. Terraform creates the Amazon SageMaker Unified Studio domain with shared IAM roles and networking.
2. Terraform enables all required blueprints on the domain (DataLake, RedshiftServerless, Bedrock services, EMR, and so on).
3. Terraform composes three project profiles (one per team), selecting the appropriate blueprints and parameters.
4. Terraform creates a project from the first available profile (All Capabilities profile).
5. Project members (SSO users, SSO groups, IAM users, or IAM roles) are assigned as owners or contributors to the created project.

What each team gets

After deployment and teams are assigned to their respective projects, each team can:

• Data Analytics team (SQL Analytics profile):
  • Query data across Amazon S3 and Amazon Redshift using SageMaker Lakehouse.
  • Manage a shared data catalog with AWS Glue.
  • Create and share SQL notebooks and dashboards.
• Machine Learning team (All Capabilities profile):
  • Run ML experiments with MLflow integration.
  • Process data at scale with Amazon EMR Serverless.
  • Access all SQL analytics and generative AI capabilities.
  • Build end-to-end ML pipelines with Workflows.
• Generative AI team (Generative AI profile):
  • Build chat agents and knowledge bases with Amazon Bedrock.
  • Create and test prompt flows and guardrails.
  • Evaluate model performance with Bedrock Evaluation.
  • Deploy serverless AI functions.

All three teams share the same governed domain, data catalog, IAM policies, and networking. This eliminates the silos that existed before. Team isolation is achieved by assigning users or groups to projects created from the appropriate project profile.

Prerequisites

Before you begin, verify the following:

• An AWS account with permissions to create and manage Amazon DataZone, AWS Identity and Access Management (IAM), Amazon Simple Storage Service (Amazon S3), Amazon Elastic Compute Cloud (Amazon EC2), and Amazon Virtual Private Cloud (Amazon VPC) resources. See Changing permissions for an IAM user for guidance.
• Terraform version >= 1.7.
• AWS Command Line Interface (AWS CLI) configured with credentials that have access to the target account and AWS Region.
• Amazon SageMaker Unified Studio available in your target Region.
• AWS IAM Identity Center configured (required only if using SSO-based project membership). If using IAM-only membership, Identity Center isn’t required.

Solution walkthrough

We complete the setup in four steps:

1. Clone the module repository.
2. Configure the Terraform variables for each team.
3. Apply the Terraform configuration.
4. Verify the platform and onboard teams.

Step 1: Clone the repository

Clone the Amazon SageMaker Unified Studio Terraform module and navigate to the quick-setup example:

git clone https://github.com/aws-ia/terraform-aws-sagemaker-unified-studio.git cd terraform-aws-sagemaker-unified-studio

The module directory structure:

Figure 2: Directory structure of the Amazon SageMaker Unified Studio Terraform module

Change into the quick-setup example directory:

cd examples/quick-setup

Step 2: Configure the Terraform variables

Copy the example variables file and edit it:

cp terraform.tfvars.example terraform.tfvars

For our multi-team scenario, we enable all three project profiles:

# Domain configuration domain_name = "acme-ai-platform" domain_description = "Multi-team AI and analytics domain" aws_region = "us-east-1" environment = "prod" # Project configuration project_name = "analytics-pilot" project_description = "Initial pilot project for the analytics team" # Enable all three team profiles enable_sql_analytics = true # Data Analytics team enable_generative_ai = true # Generative AI team enable_all_capabilities = true # ML team (includes SQL + AI + ML + EMR) # SSO user access enable_sso = true sso_users = [ "admin@example.com" ] # Project membership project_owners = { sso_users = ["a1b2c3d4-5678-90ab-cdef-EXAMPLE11111"] } project_contributors = { sso_groups = ["a1b2c3d4-5678-90ab-cdef-EXAMPLE22222"] iam_roles = ["arn:aws:iam::123456789012:role/CI-CD-DeployRole"] } # Note: If your organization doesn't use Identity Center, set enable_sso = false and use iam_users and iam_roles instead. See "Adding IAM principals to projects" below. This is a one way door decision. If you change this later on the domain and all dependent resources need to be destroyed and recreated # Optional: Use a specific VPC instead of the default # vpc_id = "vpc-0abc123def456" # subnet_ids = ["subnet-0abc123", "subnet-0def456"]

Here’s what each profile creates:

Internally, the toggles build a dynamic map of blueprints that gets passed to the blueprint module’s for_each:

locals { blueprint_configs = merge( var.enable_generative_ai ? { /* Bedrock blueprints */ } : {}, var.enable_sql_analytics ? { /* DataLake, Redshift, Lakehouse */ } : {}, var.enable_all_capabilities ? { /* EMR, ML, Workflows + all above */ } : {}, ) }

Network auto-discovery: If you don’t specify vpc_id and subnet_ids, the module automatically discovers and uses your default VPC and its subnets.

Customizing blueprint parameters: The quick-setup example uses recommended defaults. For production, you can customize Amazon Redshift capacity, Glue database names, or deployment modes in the sql_analytics_blueprint_config and generative_ai_blueprint_config locals in main.tf. For example, to increase Redshift Serverless max capacity:

"RedshiftServerless" = { deployment_mode = "ON_CREATE" parameter_overrides = { "redshiftMaxCapacity" = { value = "1024" # Increased from default 512 is_editable = false } } }

Step 3: Apply the Terraform configuration

Configure your AWS CLI credentials for the target account and Region, then:

1. Run terraform init to download the modules and providers.
2. Run terraform plan and review the output to verify:
   • An Amazon SageMaker Unified Studio domain will be created.
   • Three IAM roles will be created (domain execution, manage access, provisioning).
   • An S3 bucket for tooling storage will be created.
   • All selected blueprints will be enabled on the domain.
   • Three project profiles will be created (SQL Analytics, Generative AI, All Capabilities).
   • A project will be created from the first available profile.
   • Project memberships will be configured for SSO identities, IAM principals or both.
3. Run terraform apply and allow the apply to complete.

Figure 3: Successful terraform apply output showing the domain URL, project ID, and project profile IDs

View the key outputs:

# Domain portal URL — share this with your teams terraform output domain_url # Project URL — direct link to the created project terraform output project_url # All enabled blueprints terraform output blueprint_ids # Project profile IDs (one per team) terraform output project_profile_ids # IAM role ARNs for auditing terraform output domain_execution_role_arn terraform output manage_access_role_arn terraform output provisioning_role_arn

Step 4: Verify the platform and onboard teams

Verify the deployment. Confirm the environment is healthy before onboarding teams:

1. Open the domain_url from the Terraform output and confirm the Amazon SageMaker Unified Studio portal loads, and you can sign in using a principal that was added to the project.
2. In the portal, confirm the three project profiles (SQL Analytics, Generative AI, All Capabilities) appear under the domain.
3. Confirm the initial project created by terraform apply is listed and project members can access the project interface.
4. Cross-check the Terraform outputs (terraform output blueprint_ids, terraform output project_profile_ids) against the blueprints and profiles you expected.

Access the portal: Open the domain_url from the Terraform output. Any user added as an owner or member of the project can sign in immediately and access their project.

Create team-specific projects: The initial terraform apply creates one project. To create additional projects for each team, add more "project" sub-moduleblocks referencing different profiles:

module "genai_project" { source = "aws-ia/sagemaker-unified-studio/aws//modules/project" domain_id = module.domain.domain_id project_name = "genai-team" project_profile_id = module.generative_ai_project_profile.project_profile_id }

You can also create projects from the Amazon SageMaker Unified Studio portal using the available profiles.

Onboard additional users: To isolate teams, create separate projects using the appropriate project profiles as shown earlier, then add members (SSO users, SSO groups, IAM users, or IAM roles) to each project using the project_membership module. Each principal type can be used independently or in combination. This restricts each team to the capabilities defined by their project profile. For details on adding IAM principals, see the next section.

Adding IAM principals to projects

Amazon SageMaker Unified Studio uses project membership to control who can access a project’s resources (data, environments, and development artifacts). The Terraform module supports four principal types for project membership:

• SSO users: Individual IAM Identity Center users.
• SSO groups: IAM Identity Center groups (all members inherit access).
• IAM users: Native IAM user ARNs.
• IAM roles: IAM role ARNs (assumed by humans, services, or automation).

Project membership defines which principals are authorized to access a project. It also sets what actions they are allowed to perform as either project owners or contributors. When a principal is added to a project through project membership, they are automatically added to the domain membership list and are authorized to access the interface.

Why add IAM principals to projects?

While Identity Center users and groups cover most human access patterns, IAM principals unlock additional use cases:

Configuration

The project_owners and project_contributors variables accept any combination of principal types:

project_owners = { sso_users = ["user@example.com"] sso_groups = [] iam_users = ["arn:aws:iam::123456789012:user/platform-admin"] iam_roles = ["arn:aws:iam::123456789012:role/DataPlatformLead"] } project_contributors = { sso_users = [] sso_groups = ["a1b2c3d4-5678-90ab-cdef-EXAMPLE22222"] iam_users = ["arn:aws:iam::123456789012:user/data-engineer-1"] iam_roles = ["arn:aws:iam::123456789012:role/CI-CD-DeploymentRole"] }

Project members can be defined as owners or contributors. The AWS caller identity that runs this Terraform code is added as a project owner so that it has permission to manage project resources and update team membership. To know what permissions each of these roles have please refer to the full documentation here.

How the module registers principals

The module automatically creates the required domain-level profile for each principal before assigning membership. No manual pre-registration is needed. The module handles the full lifecycle.

IAM identity prerequisite: IAM roles and users must have the AWS managed SageMakerStudioUserIAMConsolePolicy (or equivalent) attached to access the Amazon SageMaker Unified Studio interface. This policy provides permissions for domain listing, project creation, and other portal operations. The module doesn’t automatically attach this policy to IAM roles.

Example: Granting a CI/CD pipeline access to a project

project_contributors = { iam_roles = ["arn:aws:iam::123456789012:role/GitHubActionsDeployRole"] }

The pipeline role can now create and manage environments within the project scope, without domain-wide access.

Example: IAM-only project membership

Organizations that don’t use Identity Center can manage project membership entirely through IAM principals by setting enable_sso = false in the domain module.

enable_sso = false project_owners = { iam_roles = ["arn:aws:iam::123456789012:role/PlatformAdmin"] } project_contributors = { iam_users = [ "arn:aws:iam::123456789012:user/analyst-1", "arn:aws:iam::123456789012:user/analyst-2" ] iam_roles = [ "arn:aws:iam::123456789012:role/DataScientistRole" ] }

Note: Currently, only IAM principals within the same AWS account as the domain can access the Amazon SageMaker Unified Studio portal. Cross-account IAM role access might be limited. Verify cross-account support in your Region before relying on it for production access patterns.

Additional considerations

As you move this setup toward production, consider the following areas.

Scaling to multiple environments

For production readiness, deploy separate domains for development, staging, and production using Terraform workspaces or separate state files:

# Development terraform workspace new dev terraform apply -var="domain_name=acme-ai-dev" -var="environment=dev" # Production terraform workspace new prod terraform apply -var="domain_name=acme-ai-prod" -var="environment=prod"

Cost management

The base infrastructure (domain, IAM roles, S3 bucket) has minimal ongoing costs. Primary charges occur when teams create and use environments:

• Redshift Serverless: Pay per RPU-hour when queries are running.
• EMR Serverless: Pay per vCPU and memory per second.
• Bedrock: Pay per input and output token.
• S3: Standard storage pricing.

Use the parameter_overrides in blueprint configurations to set capacity limits (for example, redshiftMaxCapacity) and control costs.

Security and governance

The module creates least-privilege service roles by default. For additional permissions, attach custom policies to the user role:

user_role_policy_arns = [ "arn:aws:iam::aws:policy/AmazonS3ReadOnlyAccess", "arn:aws:iam::123456789012:policy/CustomBedrockPolicy" ]

You can also configure VPC endpoints for private connectivity and enable AWS CloudTrail for audit logging of all Amazon DataZone API calls.

DevOps best practices

1. Version control: Store configurations in a code repository with automated CI/CD pipelines.
2. Module registry: Publish organization-specific module compositions to a private Terraform registry.

Cleanup

To destroy all resources:

# Empty the S3 bucket first terraform output s3_bucket_name aws s3 rm s3://BUCKET_NAME --recursive # Destroy all resources terraform destroy

Warning: This deletes all resources including the domain, projects, and any data stored in the S3 bucket. Additionally, extra resources created manually within the console won’t be affected by this terraform destroy.

Conclusion

In this post, we walked through a real-world scenario: building a multi-team AI and analytics unified environment where data analysts, ML engineers, and generative AI developers each get tailored capabilities on a shared, governed domain. Terraform provisions and manages the full set of Amazon SageMaker Unified Studio resources, including the domain, blueprints, project profiles, and an initial project. As your needs grow, you can extend the configuration by adding projects per team through the project sub-module.

Key benefits of this approach:

• Team-specific profiles: Each team gets exactly the blueprints they need, nothing more.
• Shared governance: One domain, one set of IAM roles, one data catalog, consistent policies.
• Infrastructure as Code: Repeatable, auditable, version-controlled deployments.
• Auto-discovery: Minimal configuration required; VPC, subnets, and instance details are discovered automatically.
• Scalable: Add teams, environments, or accounts by extending the same Terraform configuration.
• Flexible membership: Add SSO users, IAM users, IAM roles, or any combination as project members.

The Terraform module and examples are available in the Amazon SageMaker Unified Studio Terraform module repository.

Have questions or feedback? Leave us a comment or open an issue in the GitHub repository.

Additional resources

• Amazon SageMaker Unified Studio documentation
• Amazon SageMaker Unified Studio Terraform module
• Authorization in Amazon SageMaker Unified Studio
• Terraform by HashiCorp
• Automate Amazon S3 File Gateway on Amazon EC2 with Terraform

About the authors