# yaml-language-server: $schema=../../../schemas/@aws-mdaa/datascience-team.json
# Top-level team configuration that defines roles, users, and the Studio environment
# for a single data science team. Each team gets its own SageMaker Studio domain.
team:
  # List of roles which will be provided admin access to the team resources
  dataAdminRoles:
    - id: generated-role-id:data-admin

  # List of roles which will be provided usage access to the team resources
  # Can be either directly referenced Role Arns, Role Arns via SSM Params,
  # or generated roles created using the MDAA roles module.
  teamUserRoles:
    - id: generated-role-id:data-scientist

  # The role which will be used to execute Team SageMaker resources (Studio Domain Apps, SageMaker Jobs/Pipelines, etc)
  teamExecutionRole:
    id: generated-role-id:team-execution

  # The team Studio Domain config
  studioDomainConfig:
    # Authentication mode for Studio. IAM uses IAM roles/session names to identify users.
    # SSO uses IAM Identity Center (formerly AWS SSO) user IDs. (enum: IAM, SSO)
    authMode: IAM
    # VPC ID where the Studio domain will be created. Studio apps run inside this VPC
    # for network isolation. Change this to match your environment's VPC.
    vpcId: "{{context:vpc_id}}"
    # List of private subnet IDs within the VPC for Studio apps. Must have connectivity
    # to AWS services (via NAT Gateway or VPC endpoints).
    subnetIds:
      - "{{context:subnet_id}}"
    # S3 prefix where shared notebooks are stored. Team members can share notebooks
    # with each other via this path in the team's S3 bucket.
    notebookSharingPrefix: sagemaker/notebooks/

    # List of Studio user profiles which will be created.
    userProfiles:
      # The key/name of the user profile should be specified as follows:
      # If the Domain is in SSO auth mode, this should map to an SSO User ID.
      # If in IAM mode, this should map to Session Name portion of the aws:userid variable.
      "{{context:datascience_team_name}}":
        # Required if the domain is in IAM AuthMode. This is the role
        # from which the user will launch the user profile in Studio.
        # The role's id will be combined with the userid
        # to grant the user access to launch the user profile.
        userRole:
          id: generated-role-id:data-scientist