## Set up SageMaker

URL: https://docs.atlan.com/apps/connectors/lineage/amazon-sagemaker/how-tos/set-up-sagemaker

> Configure AWS credentials and permissions to connect Atlan to your SageMaker environment.

Configure AWS credentials and permissions to enable Atlan to connect to your SageMaker environment and extract lineage from your machine learning workflows.

## Prerequisites

Before you begin, make sure you have:
* AWS account with SageMaker access and IAM permissions to create users or roles
* AWS region codes where your SageMaker resources are located (for example, `us-east-1`, `eu-west-1`) for Atlan configuration

## Configure AWS authentication

Choose your authentication method and configure the necessary credentials for SageMaker access.

### IAM user

1. Sign in to the AWS Management Console.
2. Navigate to **IAM** > **Users** > **Create user**.
3. Enter the user details:
	* **User name**: `atlan-sagemaker-service`
	* Select **Provide user access to the AWS Management Console** if console access is needed
	* Choose **I want to create an IAM user**
4. Click **Next** and attach these AWS managed policies:
	* `AmazonSageMakerReadOnlyAccess`
	* `AmazonS3ReadOnlyAccess` 
	* `AmazonGlueReadOnlyAccess`
5. Complete the user creation by clicking **Create user**.
6. Create access keys for programmatic access:
	* In the user details page, go to the **Security credentials** tab
	* Click **Create access key**
	* Choose **Application running outside AWS**
	* Click **Create access key**
	* Copy and securely store the **Access Key ID** and **Secret Access Key**

### IAM role

1. Follow [the steps in the AWS Identity and Access Management User Guide](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_create_for-user.html) to create a new role in your AWS account.

2. When prompted for policies, attach these AWS managed policies to this role:
	* `AmazonSageMakerReadOnlyAccess`
	* `AmazonS3ReadOnlyAccess`
	* `AmazonGlueReadOnlyAccess`

3. [Raise a support ticket](https://docs.atlan.com/support/submit-request) to provide the AWS IAM role ARN to Atlan and get the ARN of the _Node Instance Role_ for your Atlan EKS cluster from Atlan.

4. When prompted, create a trust relationship for the role using the following trust policy. (Replace `<atlan_nodeinstance_role_arn>` with the ARN received from Atlan support.)

	```json
	{
	 "Version": "2012-10-17",
	 "Statement": [
	 {
	 "Effect": "Allow",
	 "Principal": {"AWS": "<atlan_nodeinstance_role_arn>"},
	 "Action": "sts:AssumeRole"
	 }
	 ]
	}
	```

5. Copy the **Role ARN** from the role summary page for use in Atlan configuration. See [Configure authentication](https://docs.atlan.com/llms/connectors/amazon-sagemaker/crawl-sagemaker/llms.txt).

## Configure S3 access for artifacts

Grant your IAM user or role access to the S3 buckets where SageMaker stores model artifacts, training data, and job outputs.

1. Find your SageMaker S3 buckets in the AWS Console:
	* Navigate to **Amazon SageMaker** > **Models**
	* Click on the desired model to view its details
	*Copy the S3 bucket path from the **Model artifacts** section. For example, `s3://my-sagemaker-bucket/models/`
	* For training job buckets, navigate to **Training** > **Training jobs**
	* Click on a completed training job to view its details
	* Copy the S3 bucket path from the **Output data configuration** section. For example, `s3://my-sagemaker-bucket/training-output/`
2. Add S3 permissions to your IAM user or role:
	* Go back to **IAM** and select your user or role
	* Click **Add permissions** > **Attach policies directly**
	* Click **Create policy** and paste this JSON:
		```json
		{
		"Version": "2012-10-17",
		"Statement": [
			{
			"Effect": "Allow",
			"Action": [
				"s3:GetObject",
				"s3:ListBucket",
				"s3:GetObjectVersion"
			],
			"Resource": [
				//highlight-next-line
				//replace <your-sagemaker-bucket> with your actual bucket name
				//highlight-next-line
				"arn:aws:s3:::<your-sagemaker-bucket>",
				//highlight-next-line
				"arn:aws:s3:::<your-sagemaker-bucket>/*"
			]
			}
		]
		}
		```
3. Give an unique and meaningfule name to the policy. For example, `AtlanSageMakerS3Access`) and click **Create policy**.
4. Return to your user or role and attach the newly created policy (`AtlanSageMakerS3Access`).

## Troubleshooting

If you encounter connection or authentication issues during the crawl setup, see [Connection and authentication issues](https://docs.atlan.com/llms/connectors/amazon-sagemaker/connection-and-authentication-issues/llms.txt) for detailed troubleshooting steps.

## Next steps

* [Crawl SageMaker assets](https://docs.atlan.com/llms/connectors/amazon-sagemaker/crawl-sagemaker/llms.txt): Configure and run the crawler to extract lineage from SageMaker

---