What's New

AWS has released an open-source Terraform module (terraform-aws-sagemaker-unified-studio) that enables platform teams to provision Amazon SageMaker Unified Studio domains using infrastructure-as-code workflows. The module handles domain creation, IAM role provisioning, blueprint enablement, project profile composition, and project creation through a modular, version-controlled structure. This integration is powered by the Terraform AWS Cloud Control Provider, allowing teams to incorporate SageMaker Unified Studio into existing CI/CD and IaC pipelines across development, staging, and production environments.

How It Works

• Root module deploys a full SageMaker Unified Studio (V2) domain backed by Amazon DataZone, automatically creating the required IAM roles (domain execution, domain service, query execution, provisioning, and manage access) unless existing roles are supplied.
• 3-tier IAM role resolution follows the order: user-provided ARN → pre-existing role discovered in AWS → Terraform-managed role, making the module safe to run in accounts that already have standard SageMaker Unified Studio roles.
• Sub-modules provide granular control: modules/blueprint enables environment blueprints, modules/blueprint-bootstrap creates provisioning and manage-access IAM roles, modules/project-profile composes blueprints into deployable project profiles, and modules/default-project-profile enables ToolingLite, S3Bucket, and S3TableCatalog blueprints.
• Tooling blueprint is enabled and configured by default with VPC, subnet, and S3 parameters; an optional S3 bucket for tooling environment storage is created unless an existing bucket name is provided.
• Terraform AWS Cloud Control Provider (awscc) underpins the integration, using AWS Cloud Control API to provision resources, which allows same-day support for new SageMaker Unified Studio features as they become available on the Cloud Control API.
• Bring-your-own-role (BYOR) support allows teams to create projects using pre-existing IAM roles, accommodating organizations with strict role governance policies.
• The module is hosted under the aws-ia GitHub organization, follows standard Terraform module conventions (main.tf, variables.tf, outputs.tf, versions.tf), and includes examples and automated tests.

Why It's Important

• Eliminates manual console provisioning: Platform teams can now codify SageMaker Unified Studio domain setup, removing error-prone, undocumented click-through configurations and enabling repeatable deployments.
• Enables multi-environment consistency: Version-controlled templates ensure that development, staging, and production domains are provisioned identically, reducing environment drift and configuration-related incidents.
• Accelerates enterprise adoption: Organizations already invested in Terraform-based IaC pipelines can onboard SageMaker Unified Studio without adopting a new toolchain or workflow, lowering the barrier to adoption.
• Improves governance and auditability: Infrastructure changes go through pull requests, code reviews, and version history, satisfying compliance requirements around change management for data and AI platforms.
• Modular design reduces blast radius: Independent sub-modules allow teams to manage blueprints, project profiles, and projects separately, so a change to one component doesn't require re-applying the entire domain configuration.
• Supports existing IAM role structures: BYOR support means organizations with centralized identity management can integrate without restructuring their IAM posture.

How It's Different

• vs. manual AWS Console provisioning: The Terraform module replaces one-time, manual domain setup with repeatable, auditable, version-controlled deployments that can be peer-reviewed and rolled back.
• vs. AWS CloudFormation: Unlike CloudFormation, this module integrates directly into Terraform workflows that many platform teams already use, avoiding the need to maintain parallel IaC toolchains.
• vs. AWS CDK: The module requires no programming language knowledge beyond HCL, making it accessible to infrastructure engineers who are not comfortable with TypeScript or Python-based CDK constructs.
• vs. ad-hoc Terraform using the standard AWS provider: The use of the Terraform AWS Cloud Control Provider means new SageMaker Unified Studio features are available on the day of launch rather than waiting for community-authored resource implementations in the standard hashicorp/aws provider.
• vs. building custom Terraform from scratch: The aws-ia-maintained module provides tested, opinionated defaults (IAM role resolution, blueprint configuration, S3 setup) that teams would otherwise need to research and implement themselves.
• Modular sub-module architecture: Unlike a monolithic module, the design allows teams to adopt only the components they need and manage lifecycle of blueprints, profiles, and projects independently.

When to Prefer It

• Greenfield enterprise deployments: When standing up SageMaker Unified Studio for the first time in an organization that already uses Terraform, this module provides a fast, standards-compliant starting point.
• Multi-account AWS organizations: When the same domain configuration must be replicated across dozens of AWS accounts (e.g., one per business unit or environment tier), the module enables consistent, parameterized deployments at scale.
• Regulated industries: When audit trails, change management controls, and peer-reviewed infrastructure changes are required by compliance frameworks (SOC 2, HIPAA, FedRAMP), version-controlled Terraform is the preferred approach.
• Platform engineering teams: When a central platform team manages shared data and AI infrastructure on behalf of multiple data science or analytics teams, the sub-module structure allows fine-grained delegation of blueprint and project management.
• Organizations with existing IAM governance: When a centralized identity team owns IAM roles and cannot allow tools to auto-create them, the BYOR capability makes the module viable without compromising security posture.
• CI/CD-driven infrastructure: When infrastructure changes must pass through automated pipelines (e.g., Terraform Cloud, Atlantis, GitHub Actions) before reaching production, this module fits naturally into those workflows.
• Incremental adoption: When a team wants to start with just the domain and add blueprints or project profiles later, the modular design supports phased rollout without rework.

Availability

• GA status: Generally available as of July 2, 2026; this is a production-ready release, not a preview.
• Supported regions: Available in all 15 AWS regions where SageMaker Unified Studio is supported: US East (N. Virginia), US East (Ohio), US West (Oregon), Europe (Ireland), Europe (Frankfurt), Europe (London), Europe (Paris), Europe (Stockholm), Asia Pacific (Tokyo), Asia Pacific (Seoul), Asia Pacific (Singapore), Asia Pacific (Sydney), Asia Pacific (Mumbai), Canada (Central), and South America (São Paulo).
• Pricing: The Terraform module itself is open-source and free; standard SageMaker Unified Studio, Amazon DataZone, and underlying AWS service charges (IAM, S3, VPC, etc.) apply as per existing pricing.
• Provider dependency: Requires the Terraform AWS Cloud Control Provider (hashicorp/awscc ~> 1.0) in addition to the standard AWS provider (hashicorp/aws ~> 5.0).
• Source: Module is publicly available at https://github.com/aws-ia/terraform-aws-sagemaker-unified-studio under the aws-ia organization.
• Limitation: Regional availability is bounded by SageMaker Unified Studio's own regional footprint; deployments in unsupported regions are not possible regardless of Terraform configuration.

Related Resources

• https://github.com/aws-ia/terraform-aws-sagemaker-unified-studio
• https://aws.amazon.com/blogs/devops/quickly-adopt-new-aws-features-with-the-terraform-aws-cloud-control-provider/
• https://docs.aws.amazon.com/sagemaker-unified-studio/latest/adminguide/supported-regions.html