Datazone Domain Limitations on new User Profile with Maximum limit of 6 ACTIVE or ASSIGNED users per associated account
I am creating a data mesh architecture on datazone domain with associating multiple accounts from the Central Account but when I am adding IAM role as a user into root domain of Datazone it does not allows me to after 6 users.
Getting following error
Failed to add IAM principal arn:aws:iam::accountID:role/role_name. ValidationException: Error while creating UserProfile for domainId for Account. Maximum limit of 6 ACTIVE or ASSIGNED users per associated account is currently supported.
SSO groups may allow multiple users but permissions for all users of group would be same. As Datazone guarantees data mesh architecture limitation of only 6 users is unexpected and also in Datazone service quotas no such limits are mentioned.
How we can achieve data mesh with such limits? Is there any workaround? Whether this is hard limit or soft limit?
- Newest
- Most votes
- Most comments
The limitation you're encountering with Amazon DataZone is indeed a current constraint of the service. As of the latest information available, there is a maximum limit of 6 active or assigned users (including IAM roles) per associated account in an Amazon DataZone domain.
This limit is not explicitly mentioned in the general service quotas, which is why you didn't find it there. It's a specific limitation related to associated accounts and user management within DataZone.
For implementing a data mesh architecture with DataZone given this constraint, you have a few potential workarounds:
-
Use SSO groups: As you mentioned, SSO groups can allow multiple users, albeit with the same permissions for all users in the group. This could be a way to include more users while staying within the 6-identity limit.
-
Leverage IAM roles: Instead of adding individual IAM users, you could create IAM roles that multiple users can assume. This way, you can have more than 6 actual users accessing DataZone through a smaller number of roles.
-
Optimize user assignments: Carefully plan which users truly need direct access to DataZone and assign only those critical users or roles.
-
Multiple associated accounts: If possible, you could split your users across multiple associated accounts, as the limit is per associated account.
-
Contact AWS Support: Since this limit is not listed in the standard service quotas, it might be worth reaching out to AWS Support to inquire if this limit can be increased for your use case.
Regarding whether this is a hard or soft limit, based on the error message and the fact that it's not listed in the adjustable service quotas, it appears to be a hard limit at the moment. However, AWS services often evolve, so it's worth keeping an eye on updates or contacting AWS directly for the most current information and potential alternatives.
While these workarounds can help manage the current limitation, they may not fully align with an ideal data mesh implementation. It would be beneficial to provide feedback to AWS about this limitation and how it impacts your data mesh architecture, as this could potentially influence future service improvements.
Sources
Amazon DataZone announces custom blueprints for AWS services | AWS Big Data Blog
Quotas for Amazon DataZone - Amazon DataZone
