Datazone Analytic Tools not working

It appears you're experiencing a common behavior when using Amazon DataZone's analytic tools, particularly with Amazon SageMaker and Amazon Redshift. This is not necessarily an error, but rather how DataZone manages access to these services.

When you launch an analytic tool from the DataZone portal, you are indeed switched to a federated user. This is part of DataZone's security model, where it creates temporary, federated access for users to interact with specific AWS services within the context of a DataZone project.

The federated user you're seeing (with a name starting with "datazone-usr-c-proj-") is created by DataZone to provide you with the necessary permissions to access the data and resources associated with your project, while maintaining proper access controls.

Regarding the "Assets" menu not being visible in SageMaker, this could be related to the specific permissions granted to the federated user or how the SageMaker environment is configured within your DataZone project.

For Redshift authentication issues, it's important to ensure that the necessary configurations have been set up correctly by your DataZone administrator. This includes:

1. Proper configuration of the DefaultDataWarehouseBlueprint
2. Creation of appropriate parameter sets for Redshift access
3. Setting up environment profiles with the correct permissions

To troubleshoot and resolve these issues:

1. Verify with your DataZone administrator that you have the correct permissions assigned to your user within the DataZone project.
2. Ensure that the necessary environment profiles have been set up for both SageMaker and Redshift access.
3. Check if the required AWS Secrets Manager entries have been created with the correct tags for Redshift access.
4. Confirm that the database user provided in AWS Secrets Manager has the necessary permissions (typically superuser permissions for Redshift).

If issues persist after these checks, it would be best to work with your DataZone administrator to review the project and environment configurations to ensure all necessary permissions and setups are in place for your role and project needs.

Remember, the federated user approach is a security feature of DataZone, designed to provide controlled access to AWS services within the context of your DataZone projects.

Sources
DataZone - scope of permissions | AWS re:Post
Amazon DataZone quickstart with Amazon Redshift data - Amazon DataZone
Get started with the new Amazon DataZone enhancements for Amazon Redshift | AWS Big Data Blog

It said User: arn:aws:sts::XXXXXXXXXX:assumed-role/datazone_usr_XXXXXXXX/XXXXXXX (not i masked the id) is not authorized to perform: kms:GenerateDataKey on resource: arn:aws:kms:eu-west-2:XXXXXXXXXXX:key/XXXXXXXXXXX because no identity-based policy allows the kms:GenerateDataKey action I dont undrstand why? Do I have to add new policy in IAM every time?