How can I deploy an Amazon SageMaker model to a different AWS account?

4 minute read
0

I'm training an Amazon SageMaker model on one AWS account. I want to deploy this model to an endpoint in a different AWS account.

Resolution

Account A (sandbox account)

  1. Create an AWS Key Management Service (AWS KMS) key. On the Define key usage permissions page, in the Other AWS accounts section, choose Add another AWS account. Then, enter the AWS account number for account B (the account where you want to deploy the model). Use this key for the Amazon SageMaker training job. If you don't specify an AWS KMS key, then Amazon SageMaker defaults to an Amazon Simple Storage Service (Amazon S3) server-side encryption key. You can't share or use a default Amazon S3 server-side encryption key with another AWS account.
  2. If you didn't create a training job, then create one. In the Estimator class, add the AWS KMS key that you created in the previous step. See the following example:
    linear = sagemaker.estimator.Estimator(
        ...
        output_kms_key='xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx',
        ...  
        )

Account B (deployment account)

  1. Create two AWS Identity and Access Management (IAM) policies similar to the following policies. Because these are inline policies, they're embedded in an IAM identity (a user, group, or role).

    Inline policy 1: This allows an IAM role to access the Amazon S3 resource in account A that contains the model artifacts. Replace awsdoc-example-bucket with the name of the S3 bucket where the training job output is stored:

    {
      "Version": "2012-10-17",
      "Statement": [
        {
          "Effect": "Allow",
          "Action": "s3:GetObject",
          "Resource": "arn:aws:s3:::awsdoc-example-bucket/sagemaker/linear-learner/output/model.tar.gz"
        }
      ]
    }

    Inline policy 2: This allows a future IAM role to use the AWS KMS key in account A. For Resource, specify the account ID for account A and the key ID:

    {
      "Version": "2012-10-17",
      "Statement": [
        {
          "Sid": "AllowUseOfTheKey",
          "Effect": "Allow",
          "Action": [
            "kms:Encrypt",
            "kms:Decrypt",
            "kms:ReEncrypt*",
            "kms:GenerateDataKey*",
            "kms:DescribeKey"
          ],
          "Resource": [
            "arn:aws:kms:us-east-1:AccountA:key/xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx"
          ]
        }
      ]
    }
  2. Create an IAM role for Amazon SageMaker. This role has the AmazonSageMakerFullAccess policy.

  3. Attach the two inline policies that you created in step 1 to the role that you created in step 2. The role has three policies: AmazonSageMakerFullAccess and the two inline policies.

Account A (sandbox account)

Create an S3 bucket policy for the bucket to store the training job output. This bucket policy allows the role that you created in the previous section to access the model artifact:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {
        "AWS": "arn:aws:iam::AccountB:root"
      },
      "Action": "s3:GetObject",
      "Resource": "arn:aws:s3:::awsdoc-example-bucket/sagemaker/linear-learner/output/model.tar.gz",
      "Condition": {
        "StringEquals": {
          "aws:PrincipalArn": "arn:aws:iam::AccountB:role/AmazonSageMaker"
        }
      }
    }
  ]
}

Note: In this example, replace AccountB with the AWS account ID for the deployment account. Replace AmazonSageMaker with the name of the role that you created in the deployment account. Replace awsdoc-example-bucket with the S3 bucket that the training job output is stored in.

Create the deployment model

  1. Open the Amazon SageMaker console.
  2. On the navigation pane, under Inference, choose Models.
  3. Choose Create model, and then enter a name for your model.
  4. For IAM role, choose Enter a custom IAM role ARN. Then, complete your custom ARN with the following:
    For YourAccountID, enter the ID for account B.
    For YourRole, enter the name of the IAM role that you created in account B.
  5. For Location of inference code image, provide the registry path where the inference code image is stored. The inference image is stored in either Amazon Elastic Container Registry (Amazon ECR) or a private Docker registry.
  6. For Location of model artifacts, provide the URL where model artifacts are stored in Amazon S3.
  7. At the bottom of the page, choose Create model. For more information about creating a model, see Create a pipeline model.

Create the endpoint configuration

  1. Open the Amazon SageMaker console.
  2. On the navigation pane, under Inference, choose Endpoint configurations.
  3. Choose Create endpoint configuration. Then, under Production variants, add the model that you created in the previous section.
  4. Choose Create endpoint configuration.

Create the endpoint

  1. Open the Amazon SageMaker console.
  2. On the navigation pane, under Inference, choose Endpoints.
  3. Choose Create endpoint, and then select the endpoint configuration that you created in the previous section.
  4. Choose Create endpoint.

You're now ready to deploy the model from account A to account B.

Note: If you don't want to retrain your Amazon SageMaker model for encryption, you can encrypt the object as a post-processing step. To encrypt an existing object, use a customer managed key to copy the object back to itself after it's encrypted with SSE-KMS.

AWS OFFICIAL
AWS OFFICIALUpdated 3 months ago
2 Comments

Hi, does this mean I need to retrain the whole model in order to encrypt it with the KMS key? Shouldn't that be doable as a post-processing step?

replied 4 months ago

Thank you for your comment. We'll review and update the Knowledge Center article as needed.

profile pictureAWS
MODERATOR
replied 4 months ago