Provision SSO user via Cloudformation AWS::SageMaker::UserProfile is not working

Question

I have issue that when running a CloudFormation stack with `AWS::SageMaker::UserProfile` in it, it did create the user profile under sagemaker domain, but when I tried to login to the sagemaker with the specified user via SSO, it always got rejected and saying the user is not added to the domain.

While if I add the user manually with AWS Console GUI, it works. So I suspect it's an issue of CloudFormation with `AWS::SageMaker::UserProfile` resource.

And I also found this github issue https://github.com/aws-cloudformation/cloudformation-coverage-roadmap/issues/1128

Could someone help me confirm it? Or I misunderstand something?

Answer

The symptoms you are describing aligns to the github [issue](https://github.com/aws-cloudformation/cloudformation-coverage-roadmap/issues/1128).  Are you able to workaround this issue by manually associating the same **User** referenced via CloudFormation User Profile with the **Domain**. Ignore the error you will see when doing this action, but internally it will call AssociateProfile API.  Also, can you confirm whether you are using domainID in the CloudFormation template:

```
UserProfile:
    Type: AWS::SageMaker::UserProfile
    Properties: 
      DomainId: !GetAtt StudioDomain.DomainId
      UserProfileName: !Ref UserProfileName
      UserSettings:
        ExecutionRole: !GetAtt SageMakerExecutionRole.Arn

```

Provision SSO user via Cloudformation AWS::SageMaker::UserProfile is not working

Relevant content