Spoke project deploy fails at ProjectMembership: IAM-role members can no longer be added (possible SMUS service-side change)

[sonorone]

Summary

Deploying a spoke DataOps project fails on the monitor-cr-project-membership
resource (AWS::DataZone::ProjectMembership) with
CreateProjectMembership ... User is not permitted to perform operation
(AccessDenied, HTTP 403).

Note

The same configuration deployed successfully ~2 weeks ago (late May 2026) on
MDAA 1.5.0. It now fails, and the relevant MDAA code is unchanged in between
(see Notes) — so this may be an AWS SMUS / DataZone service-side behavior
change rather than an MDAA defect. Filing here so MDAA can track and adapt to
the new service behavior.

Deployment log (excerpt)

CREATE_FAILED | AWS::DataZone::ProjectMembership | constructsagemaker...membership399EEAD8
Resource handler returned message: "User is not permitted to perform operation:
CreateProjectMembership (Service: DataZone, Status Code: 403, Request ID:
6886c7c7-6798-400c-a617-c742d244a1d8) (SDK Attempt Count: 1)"
(RequestToken: 1f6c988a-7713-735a-d17a-26dae207bb52, HandlerErrorCode: AccessDenied)

❌ failed: DeploymentError: Resource updates failed:
└─
└─ construct
└─ sagemaker
└─ project-dataops
└─ monitor-cr-project-membership
(AWS::DataZone::ProjectMembership
constructsagemakerprojectdataopsmonitorcrprojectmembership399EEAD8)
🛑 Resource handler returned message: "User is not permitted to perform
operation: CreateProjectMembership (Service: DataZone, Status Code: 403,
Request ID: 6886c7c7-6798-400c-a617-c742d244a1d8) (SDK Attempt Count: 1)"
(RequestToken: 1f6c988a-7713-735a-d17a-26dae207bb52,
HandlerErrorCode: AccessDenied)

Environment

• DataZone / SageMaker Unified Studio domain: V2, identity mode
  IAM Identity Center (SSO), userAssignment: MANUAL.
• Previously working: MDAA 1.5.0 (~2 weeks ago). Now failing.

What we observed

1. The project is created by the CDK cfn-exec role, which is auto-added as
   the project owner at creation. That role remains a valid member.
2. Adding any additional IAM role (e.g. the project's custom-resource role)
   as a member now fails — for both PROJECT_OWNER and
   PROJECT_CONTRIBUTOR.
3. The additional role's DataZone user profile is in ASSIGNED status
   (the creating cfn-exec role's profile is ACTIVATED), and it cannot be moved
   ASSIGNED -> ACTIVATED via update-user-profile
   (ValidationException: invalid status update).
4. MDAA's check_user_profiles Lambda ("UserProfileManager" custom resource)
   only calls get_user_profile — it does not create or activate the profile —
   and the spoke stack contains no native AWS::DataZone::UserProfile resource.

Impact

In a MANUAL/IdC domain, the project deploy can no longer add its
custom-resource role (or other IAM roles) to the project, so the deploy fails at
the membership step every time.

Expected / requested

• Confirm whether SMUS / DataZone changed the rules for adding IAM-role members
  to projects (esp. members whose user profile is in ASSIGNED status).
• Update MDAA to follow the current SMUS behavior — e.g. ensure additional
  IAM-role members have an ACTIVATED user profile before creating the
  membership, rather than only checking that the profile exists.

Notes

• project.ts (the membership step) and the check_user_profiles Lambda are
  unchanged between MDAA v1.5.0 and v1.6.0, which points away from an MDAA
  code regression and toward a service-side change in the ~2-week window.

[suddash24]

Thanks for the detailed report — the reproduction steps and observations are very helpful.

We agree this is not an MDAA code regression — the relevant code (project.ts and check_user_profiles Lambda) is unchanged between v1.5.0 and v1.6.0. The timing strongly suggests a service-side behavior change in how DataZone handles IAM-role user profiles for project membership.

Temporary workaround:

Before deploying the spoke project stack, manually ensure the IAM role's user profile is in ACTIVATED status in your DataZone domain. You can do this via the SMUS console (Domain → User management → Add the IAM role), or via CLI:

aws datazone create-user-profile \
   --domain-identifier <domain-id> \
   --user-identifier <iam-role-arn> \
   --user-type IAM \
   --region <region>

Once the profile is active, the CreateProjectMembership call should succeed during the CDK deploy.

We're tracking this and will update here once we have a fix.