Amazon SageMaker now supports data lineage in IAM-based domains
IAM-based SageMaker domains now get full data lineage with column-level tracking, interactive graphs, and a new event deletion API.
View original announcement →Visual Summary
What's New
Amazon SageMaker Unified Studio has extended OpenLineage-compatible data lineage support to IAM-based domains, closing a gap that previously limited this capability to IAM Identity Center-based domains only. The feature captures lineage events from Apache Spark jobs running on Amazon EMR, AWS Glue, SageMaker Visual ETL, and notebooks, providing an interactive visual graph of data movement from source to consumption. A new DeleteLineageEvent API is also introduced, enabling programmatic removal of previously published lineage events across both domain types.
How It Works
- OpenLineage event capture: Lineage events are automatically captured from Apache Spark jobs running on Amazon EMR, AWS Glue, SageMaker Visual ETL, and notebooks, conforming to the OpenLineage open standard specification.
- Interactive lineage graph: Data flow is rendered as a directed graph with nodes representing datasets, jobs, and job runs, connected by edges that show upstream and downstream dependencies.
- Two graph traversal modes: Query Graph mode performs fast server-side traversal for efficient lineage path retrieval; Event Timestamp mode uses client-side recursive expansion to expose detailed column-level lineage data.
- Configurable graph depth: Users can control how many hops (1–5 levels) of upstream and downstream nodes are displayed, allowing both high-level and granular views.
- Dataset-only view: A toggle hides job and job run nodes, simplifying the visualization to show only data asset relationships.
- Programmatic API access: The
PostLineageEventAPI accepts OpenLineage run event payloads;GetLineageEvent,ListLineageEvents,QueryGraph,GetLineageNode, andListLineageNodeHistorysupport retrieval and traversal; the newDeleteLineageEventAPI enables removal of specific published events. - IAM-based authentication: In IAM-based domains, lineage operations are authorized using standard AWS IAM roles and policies, without requiring IAM Identity Center federation.
Why It's Important
- Broader domain coverage: Organizations that deployed SageMaker Unified Studio with IAM-based authentication—common in enterprise environments with existing IAM governance structures—can now access data lineage without migrating to IAM Identity Center.
- Data governance and compliance: End-to-end lineage tracking helps organizations satisfy regulatory requirements (e.g., GDPR, CCPA, HIPAA) by providing auditable records of how data originates, transforms, and is consumed.
- Faster root-cause analysis: Column-level lineage in Event Timestamp mode allows data engineers and analysts to pinpoint exactly where data quality issues were introduced in a pipeline.
- Impact analysis: Before modifying a dataset or pipeline, teams can visualize downstream dependencies to assess the blast radius of a change, reducing unintended breakages.
- OpenLineage interoperability: Adherence to the OpenLineage standard means lineage events from third-party tools can be ingested and managed within the same graph, avoiding vendor lock-in.
- Event lifecycle management: The new
DeleteLineageEventAPI gives teams control over lineage data hygiene, enabling removal of erroneous or test events from production lineage graphs.
How It's Different
- IAM-native support vs. Identity Center requirement: Unlike the prior state where data lineage required IAM Identity Center federation, this update enables the same capability using native IAM roles, making it accessible to a wider set of existing AWS deployments.
- OpenLineage standard vs. proprietary formats: SageMaker's lineage implementation uses the open OpenLineage specification rather than a proprietary schema, enabling integration with any OpenLineage-compatible tool (e.g., Apache Airflow, dbt, Marquez).
- Column-level granularity: Event Timestamp mode exposes field-to-field column lineage, which goes beyond dataset-level tracking offered by many competing lineage tools.
- Dual visualization modes: The combination of a fast server-side Query Graph mode and a detailed client-side Event Timestamp mode gives users flexibility that single-mode lineage tools lack.
- Integrated multi-service capture: Lineage is captured natively across EMR, Glue, Visual ETL, and notebooks within a single unified graph, whereas standalone lineage tools typically require separate connectors and manual stitching.
- Programmatic event deletion: The
DeleteLineageEventAPI is a differentiating capability not universally available in managed lineage services, providing explicit control over the lineage event store.
When to Prefer It
- IAM-only environments: Use this feature when your SageMaker Unified Studio domain is configured with IAM-based authentication and migrating to IAM Identity Center is not feasible or desired.
- Multi-engine Spark pipelines: Ideal when data flows across multiple AWS compute services (EMR, Glue, Visual ETL) and you need a single unified lineage graph rather than siloed per-service tracking.
- Regulated industries: Prefer this when your organization must demonstrate data provenance and transformation history for compliance audits in sectors such as financial services, healthcare, or government.
- Data quality troubleshooting: Use Event Timestamp mode and column-level lineage when debugging data discrepancies that require tracing a specific field's transformation history across multiple job runs.
- Large-scale data mesh architectures: Leverage the configurable graph depth and dataset-only view when managing complex data mesh topologies where visualizing full job-level detail would be overwhelming.
- OpenLineage ecosystem integration: Choose this when you already use OpenLineage-compatible tools (Airflow, dbt, Marquez) and want to centralize lineage management within AWS without abandoning existing instrumentation.
- Lineage data lifecycle management: Use the
DeleteLineageEventAPI when running automated pipelines that generate test or ephemeral lineage events that should not pollute production lineage graphs.
Availability
- General Availability: This feature is generally available (GA) as of July 7, 2026; it is not a preview or beta release.
- Supported regions (15 total): US East (N. Virginia), US East (Ohio), US West (Oregon), Europe (Ireland), Europe (Frankfurt), Europe (London), Europe (Paris), Europe (Stockholm), Asia Pacific (Tokyo), Asia Pacific (Seoul), Asia Pacific (Singapore), Asia Pacific (Sydney), Asia Pacific (Mumbai), South America (São Paulo), and Canada (Central).
- Domain type support: Available for both IAM-based and IAM Identity Center-based SageMaker Unified Studio domains.
- Pricing: No separate pricing is listed for data lineage; it is included as part of Amazon SageMaker Unified Studio—consult the SageMaker pricing page for domain and API call costs.
- Lineage sources: Lineage capture is supported for Apache Spark jobs on Amazon EMR, AWS Glue, SageMaker Visual ETL, and notebooks; other compute sources are not explicitly listed as supported.
- Graph depth limitation: Configurable depth is bounded between 1 and 5 hops; deeper traversals beyond 5 levels are not supported in a single query.
Related Resources
- https://docs.aws.amazon.com/sagemaker-unified-studio/latest/adminguide/supported-regions.html
- https://docs.aws.amazon.com/sagemaker-unified-studio/latest/userguide/datazone-visualizing-data-lineage-iam-mode.html
- https://docs.aws.amazon.com/sagemaker-unified-studio/latest/userguide/datazone-data-lineage-apis.html