r/aws_sagemaker_domain: add trusted_identity_propagation_enabled argument

[psantus]

Rollback Plan

If a change needs to be reverted, we will publish an updated version of the library.

Changes to Security Controls

No changes to security controls. This PR adds a new optional configuration field that enables Trusted Identity Propagation, which enhances access control and auditing capabilities when used with SSO authentication.

Description

Adds support for enabling Trusted Identity Propagation (TIP) in SageMaker domains through the trusted_identity_propagation_enabled argument in the domain_settings block.

When enabled, user identities from IAM Identity Center are propagated through the domain to TIP enabled AWS services, providing enhanced access control and auditing capabilities.

Changes:

• Add trusted_identity_propagation_enabled boolean field to domain_settings schema (defaults to false)
• Implement API integration for Create, Update, and Read operations
• Add validation requiring auth_mode = "SSO" when field is true
• Update documentation with field description and constraints
• Add acceptance test with SSO authentication

Relations

Closes #44962

References

• AWS Blog: Simplify access control and auditing for Amazon SageMaker Studio using trusted identity propagation
• AWS API Reference: TrustedIdentityPropagationSettings
• AWS API Reference: CreateDomain

Output from Acceptance Testing

%TF_ACC=1 go test -v ./internal/service/sagemaker -run TestAccSageMaker_serial/Domain/trustedIdentityPropagation -timeout 60m                        
 
2025/11/06 16:38:58 Creating Terraform AWS Provider (SDKv2-style)...
2025/11/06 16:38:58 Initializing Terraform AWS Provider (SDKv2-style)...
=== RUN   TestAccSageMaker_serial
=== PAUSE TestAccSageMaker_serial
=== CONT  TestAccSageMaker_serial
=== RUN   TestAccSageMaker_serial/Domain
=== RUN   TestAccSageMaker_serial/Domain/trustedIdentityPropagation
--- PASS: TestAccSageMaker_serial (826.14s)
    --- PASS: TestAccSageMaker_serial/Domain (826.14s)
        --- PASS: TestAccSageMaker_serial/Domain/trustedIdentityPropagation (826.14s)
PASS
ok      github.com/hashicorp/terraform-provider-aws/internal/service/sagemaker  830.931s

[github-actions]

Community Guidelines

This comment is added to every new Pull Request to provide quick reference to how the Terraform AWS Provider is maintained. Please review the information below, and thank you for contributing to the community that keeps the provider thriving! 🚀

Voting for Prioritization

• Please vote on this Pull Request by adding a 👍 reaction to the original post to help the community and maintainers prioritize it.
• Please see our prioritization guide for additional information on how the maintainers handle prioritization.
• Please do not leave +1 or other comments that do not add relevant new information or questions; they generate extra noise for others following the Pull Request and do not help prioritize the request.

Pull Request Authors

• Review the contribution guide relating to the type of change you are making to ensure all of the necessary steps have been taken.
• Whether or not the branch has been rebased will not impact prioritization, but doing so is always a welcome surprise.