# Controlled access to assets with Amazon SageMaker Assets Controlled access to assets Use Amazon SageMaker Assets to provide controlled and regulated access to *assets*, models or data tables, belonging to your organization. Within SageMaker Assets, users from different AWS accounts can create and share assets related to specific business problems without additional administrator overhead. Instead of having permissions being statically tied to their identity, users can provide permissions to assets that they’re using for their active workflows. Assets are ML assets or data assets. ML assets are metadata that point to Amazon SageMaker Feature Store feature groups or SageMaker Model Registry Model Groups. Data assets are metadata that point to Amazon Redshift tables or AWS Glue tables. For example, the asset for a model group contains the model group name and the Amazon Resource Name (ARN) for the model package group. The asset points to the underlying collection of models. The asset itself can be shared between users. Users can create assets for their own projects. They can make them visible to users who aren't members of those projects. The users who aren't project members can search through the assets and read their metadata. They can use the metadata to determine whether they want to access to the underlying source of data. To understand the SageMaker Assets workflow better, imagine that you have two groups of users in your organization, Group A and Group B. The users in Group A are looking to predict home prices. They’re looking to collaborate with the users in Group B who are in a different AWS account. They have housing data stored in AWS Glue tables. They also have different models saved as model packages within a model group. With SageMaker Assets, the users in Group A can share their AWS Glue tables and model packages with the users in Group B in a few clicks. Without administrator intervention, the users in Group A provided precisely scoped permissions to the users in Group B. Users can create assets and publish them to make them visible throughout the organization. Other users can request access to those assets. **Topics** + [ # Set up SageMaker Assets (administrator guide) ](sm-assets-set-up.md) + [ # Work with assets (user guide) ](sm-assets-user-guide.md) # Set up SageMaker Assets (administrator guide) **Important** SageMaker Assets is only available in Amazon SageMaker Studio. If you're using Amazon SageMaker Studio Classic, you must migrate to Studio. For more information about Studio and Studio Classic, see [Machine learning environments offered by Amazon SageMaker AI](machine-learning-environments.md). For information about migrating, see [Migration from Amazon SageMaker Studio Classic](studio-updated-migrate.md). As business needs change, your users need to collaborate effectively to solve business problems as they arise. To solve them, users must share data and models with each other. SageMaker Assets integrates Amazon SageMaker Studio with Amazon DataZone, a data management service. SageMaker Assets is a platform that helps your users share models and data with each other. You can use the following information to set up the integration between SageMaker Assets and Amazon DataZone. You create an Amazon DataZone domain for your business line or organization. The *domain* is the core feature of Amazon DataZone. All of your users' data and models exist within the domain. Within the Amazon DataZone domain, a subset of your users work on specific *projects*. A project typically corresponds to a particular business problem. Within the project, members can create datasets and models. By default, project members only have access to the data and models within the project. They can provide access to their data and models to other users within the organization. Within the project, you create environments. For SageMaker Assets specifically, an environment is a collection of configured resources used to launch Amazon SageMaker Studio. For more information about the terminology used in Amazon DataZone, see [Terminology and concepts](https://docs.aws.amazon.com/datazone/latest/userguide/datazone-concepts.html). **Important** Depending on the set up you choose, Amazon SageMaker Studio uses one of the following: An Amazon SageMaker AI domain that Amazon DataZone creates as part of your SageMaker AI environment. Your existing Amazon SageMaker AI domain that you migrate to Amazon DataZone You can access Studio from the Amazon SageMaker AI domain, but we recommend accessing it from the project you've created. For information about accessing Studio, see [Work with assets (user guide)](sm-assets-user-guide.md). ## Set up Amazon DataZone with a new SageMaker AI domain Use the steps in the following list and the documentation it references to set up Amazon DataZone with an Amazon SageMaker AI domain that it creates. 1. Create an Amazon DataZone domain that corresponds to your users' organization or business line. For information about creating an Amazon DataZone domain, see [Create domains](https://docs.aws.amazon.com/datazone/latest/userguide/create-domain.html). 1. Enable the SageMaker AI blueprint within Amazon DataZone. For information about enabling the SageMaker AI blueprint, see [Enable built-in blueprints in the AWS account that owns the Amazon DataZone domain](https://docs.aws.amazon.com/datazone/latest/userguide/working-with-blueprints.html#enable-default-blueprints). 1. Create a project within the domain that corresponds to the business problem that users in your domain are solving. For information about creating a project, see [Create a new project](https://docs.aws.amazon.com/datazone/latest/userguide/create-new-project.html). 1. Create an environment profile that you can use as a template to create SageMaker AI environments for your users. For information about creating an environment profile, see [Create an environment profile](https://docs.aws.amazon.com/datazone/latest/userguide/create-environment-profile.html). 1. Create a SageMaker AI environment. Within the project, your users use the SageMaker AI environment to launch Amazon SageMaker Studio. Within Studio, they can create assets and use SageMaker Assets to share them. For information about creating an environment, see [Create a new environment](https://docs.aws.amazon.com/datazone/latest/userguide/create-environment-profile.html). 1. Add SageMaker AI as one of the trusted services within Amazon DataZone. To add SageMaker AI as one of the services, see [Add SageMaker AI as a trusted service in the AWS account that owns the Amazon DataZone domain](https://docs.aws.amazon.com/datazone/latest/userguide/working-with-blueprints.html#add-sagemaker-as-trusted-service). ## Set up Amazon DataZone with your SageMaker AI domain Use the steps in the following list and the documentation it references to set up Amazon DataZone with an existing Amazon SageMaker AI domain. 1. Create an Amazon DataZone domain that corresponds to your users' organization or business line. For information about creating an Amazon DataZone domain, see [Create domains](https://docs.aws.amazon.com/datazone/latest/userguide/create-domain.html). 1. Enable the SageMaker AI blueprint within Amazon DataZone. For information about enabling a custom blueprint, see [Amazon DataZone custom AWS service blueprints](https://docs.aws.amazon.com/datazone/latest/userguide/working-with-custom-blueprint.html). 1. Create a project within the domain that corresponds to the business problem that users in your domain are solving. For information about creating a project, see [Create a new project](https://docs.aws.amazon.com/datazone/latest/userguide/create-new-project.html). 1. Enable SageMaker AI as one of the trusted services within Amazon DataZone. To enable SageMaker AI as one of the services, see [Add Amazon SageMaker AI as a trusted service in the AWS account that owns the Amazon DataZone domain ](https://docs.aws.amazon.com/datazone/latest/userguide/working-with-blueprints.html#add-sagemaker-as-trusted-service). 1. Create Amazon DataZone users within the SageMaker AI domain. 1. Onboard existing users to the Amazon DataZone domain. **Note** If your SageMaker AI users are SSO and your Amazon DataZone domain is SSO, you can automatically map the users from the Amazon SageMaker AI domain to the Amazon DataZone domain. To onboard existing SageMaker AI users, run the [Amazon DataZone Import SageMaker AI Domain](https://github.com/aws/amazon-sagemaker-examples/tree/default/%20%20%20ml_ops/sm-datazone_import) script in your environment. You must pass the name of your AWS Region and the AWS account ID of your Amazon SageMaker AI domain as arguments. The following is an example AWS CLI command that runs the script. ``` python example-script AWS Region 111122223333 ``` The script does the following: 1. Asks you for your Amazon SageMaker AI domain ID. 1. Asks you for your Amazon DataZone domain ID. 1. Asks you for your Amazon DataZone project. 1. Prompts you to specify the users that you're importing. 1. Adds tags to your users and the Amazon SageMaker AI domain. 1. Map your Amazon DataZone users to your SageMaker AI user profiles. For each SageMaker AI user profile, the script will prompt you for a Amazon DataZone user ID. You can modify the script for your own use case. 1. Attaches a federation role to the environment, so that Amazon DataZone can access your Amazon SageMaker AI domain domain and migrate it. The script goes through each user in the Amazon SageMaker AI domain and prompts you to specify the corresponding user in the Amazon DataZone domain. It automatically adds tags for the user in the Amazon DataZone domain to the users in the corresponding SageMaker AI domain. It also updates the custom environment blueprint with the mapping between users in each domain. **Note** The SageMaker AI environment uses the latest version of the SageMaker Distribution Image. SageMaker AI Distribution Images have popular libraries packages for machine learning. For more information, see [SageMaker Studio image support policy](sagemaker-distribution.md). After you've created the environment, you can create AWS Glue and Amazon Redshift tables and databases. For more information, see [Query data in Athena or Amazon Redshift](https://docs.aws.amazon.com/datazone/latest/userguide/query-athena-with-deep-link-in-project.html). ## Viewing and modifying your users' permissions After you create a SageMaker AI environment, you can change your users' permissions to suit the needs of your organization. The SageMaker AI blueprint specifies permissions for all of your users. They can perform actions with all of the SageMaker AI services, but the permissions are scoped down to resources created within the Amazon DataZone domain. **Important** The environment that you create uses an IAM role that has limited permissions and a permissions boundary. To change your users' permissions, you can modify or replace the permissions boundary. For example, you can change the permissions boundary if your users need access to a resource such as an Amazon S3 bucket that has been created within the environment. You can view the permissions in the ARN of the IAM role used to create the SageMaker AI domain. Use the following procedure to view or edit the permissions of the IAM role of your users. **To view or edit the permissions of your users** 1. Open the [ Amazon SageMaker AI console](https://console.aws.amazon.com/sagemaker). 1. Choose **Domains**. 1. Choose the name of the domain that has the same name as your Amazon DataZone domain. 1. Choose **Domain settings**. 1. Under **Execution role**, copy the ARN of the execution role. 1. Open the [ IAM console](https://console.aws.amazon.com/IAM). 1. Choose **Roles**. 1. Paste the ARN and delete everything except the role name after the last forward slash. 1. Choose the role to view the permissions. 1. Under **Permissions**, modify the policies to suit the needs of your organization. 1. (Optional) Select **Permissions boundary**, and choose **Set permissions boundary**. 1. Select a policy to set as the permissions boundary. # Work with assets (user guide) Use SageMaker Assets to seamlessly collaborate on machine learning projects with other individuals in your organization. With SageMaker Assets, you and your collaborators create and share models and data tables with each other. Within SageMaker Assets, these models and data tables are known as *assets*. SageMaker Assets is a feature within Amazon SageMaker Studio. You or your administrator create a Studio environment within an Amazon DataZone project. For more information about setting up Amazon DataZone, see [Set up SageMaker Assets (administrator guide)](sm-assets-set-up.md). Assets are ML assets or data assets. ML assets are metadata that point to the following: + Feature Store feature groups + SageMaker AI model groups The underlying model groups and feature groups are the sources of data. If you update a feature group or model group, the asset for the model group or feature group gets updated within the day. Data assets are metadata that point to the following: + Amazon Redshift tables + AWS Glue tables For data assets, the data source is the mechanism that pulls metadata from the AWS Glue tables and Amazon Redshift tables into the asset. For example, a data source pulls the metadata from an AWS Glue table into the asset for that table. You can make an asset visible to everyone in your organization by publishing it. Individuals can review the metadata in the asset and request access. If you provide access, they get access to the underlying machine learning source of data or table. Your administrator has likely given you access to the feature groups, model groups, and tables. If they haven't, see the information in [Set up SageMaker Assets (administrator guide)](sm-assets-set-up.md) to help you get started. The following sections provide reference information for feature groups and model groups. ## Feature groups Amazon SageMaker Feature Store provides a centralized location to help you store and manage your features. It's a highly performant repository that you can use for feature engineering. Within Feature Store, features are stored in a feature group. A feature group is a collection of features related to a project that you're working on. For example, if you're working on a project related to predicting housing prices, a feature group might include features such as location or number of bedrooms. For more information about how you can use feature groups to streamline the process of feature engineering, see [Create, store, and share features with Feature Store](feature-store.md). ## Model groups You can use SageMaker AI model groups within SageMaker Model Registry to organize and manage different versions of your models. You can compare the different versions of the models to see which one performs best for your use case. For more information about SageMaker Model Registry, see [Model Registration Deployment with Model Registry](model-registry.md). The following is background information on Amazon Redshift and AWS Glue. Amazon Redshift is a large scale data warehousing service that provides fast query performance on large datasets. For more information about Amazon Redshift, see [Amazon Redshift Serverless](https://docs.aws.amazon.com/redshift/latest/gsg/new-user-serverless.html). AWS Glue is an extract, transform, load (ETL) service that you can use to simplify the process of data preparation. For more information about AWS Glue, see [What is AWS Glue?](https://docs.aws.amazon.com/glue/latest/dg/what-is-glue.html) You can use the SQL editor to connect AWS Glue and Amazon Redshift databases and run queries. You can share any tables that you create in the editor within SageMaker Assets. For more information, see [Data preparation with SQL in Studio](sagemaker-sql-extension.md). **Topics** + [ ## Terminology and Concepts ](#sm-assets-terminology) + [ ## Step 1: Access SageMaker Assets ](#sm-assets-access) + [ ## Step 2: Share assets and manage access to them ](#sm-assets-share) + [ ## Step 3: Manage access requests ](#sm-assets-manage-requests) + [ ## Step 4: Find assets and request access to them ](#sm-assets-request-access) + [ ## Step 5: Use a shared asset in your machine learning workflows ](#sm-assets-consume) ## Terminology and Concepts Before you get started with using SageMaker Assets, it's helpful to familiarize yourself with the following terminology and concepts: + Asset – The metadata that points to the models or data tables that you're sharing. You either request access to an asset that someone else owns or share your asset with others. You and your teammates access the asset and the underlying data table or model associated with it. + Subscribed assets – To request access to an asset, you submit a subscription request. If your request is approved, the asset appears under your subscribed assets. + Owned assets – The assets that you've shared with your teammates. + Asset catalog – The assets that you've shared across your organization. ## Step 1: Access SageMaker Assets Access SageMaker Assets to view your assets and share them with others. Use the following information to help you get started with using it. You access SageMaker Assets from a *project* within an Amazon DataZone domain. A project is a collaboration between you and your team members. Within the project, you and the other members of your project have access to the assets that you and your other team members create within the inventory catalog. You can publish the assets to the published catalog to make them visible to other individuals in your organization. Those individuals can request access to your asset. If you provide them with access, they can get access to the updated source of data. For example, if an individual subscribes to an AWS Glue table that you update, they can access the updated AWS Glue table in real time. Use the following procedure to access SageMaker Assets. **To access SageMaker Assets** 1. Open the [ Amazon DataZone](https://console.aws.amazon.com/datazone) console. 1. Choose **View domains**. 1. Next to the domain containing your project, choose **Open data portal**. 1. Under **Analytics Tools**, choose **SageMaker AI Studio**. 1. Choose **Open Amazon SageMaker AI**. 1. Choose **Assets**. The assets that have been shared with you are under **Subscribed assets**. The assets that you and your project members create are under **Owned assets**. The assets that you and the other members of your organization have published are in the **Assets catalog**. ## Step 2: Share assets and manage access to them After you create machine learning models, feature groups, or data tables, you can make them visible to the individuals collaborating with you on your project or your organization more broadly. You can respond to requests for access to the asset. If you approve an individual's request, they can modify the asset's underlying source of data. When you're sharing an asset, you have two options: + Publish to asset catalog – Make the asset visible to everyone in your organization + Publish to inventory – Make the asset visible to everyone working on your project If you've published your asset to the asset catalog, individuals in your organization can find it in the assets catalog. They can view your asset's metadata and decide if they want to request access to them. If you approve their request, they get access to the underlying source of data. If you publish to inventory, you and the other members of your project can access the asset without any additional action. Assets published to the inventory only appear under **Owned assets**. Assets published to the catalog appear under **Owned assets** and **Assets catalog**. When you publish a data table, you must create a data source that pulls the metadata from the underlying AWS Glue table or Amazon Redshift table into the asset. Use the following procedures to publish a AWS Glue or Amazon Redshift table. ------ #### [ Publish an AWS Glue table ] To publish an asset for an AWS Glue table, you create a data source for it and publish it. A data source is the mechanism that pulls the metadata from the AWS Glue table into the asset. Use the following procedure to publish an AWS Glue table. **To publish a AWS Glue table** 1. Navigate to the **SageMaker Assets** landing page. 1. Select **Owned assets**. 1. Choose **View data sources**. 1. Choose **Create data source**. 1. For **Name**, specify a name for the data source. 1. For **Description**, provide a description. 1. For **Type**, select **AWS Glue**. 1. For **Data selection**, select the database containing the AWS Glue table. 1. For **Table selection criteria**, specify the name of the table. **Note** Even though you can specify more than one table, we strongly suggest providing only one table name. 1. Choose **Next**. 1. + For **Publish asset to the catalog**, select **Yes** to publish to the asset catalog. + For **Publish asset to the catalog**, select **No** to publish to the asset catalog. 1. Choose **Next**. 1. Under **Asset details**, choose **Run on a schedule** or **Run on demand** to determine how the metadata from the AWS Glue table is pulled into the asset. 1. (Optional) If you choose **Run on a schedule**, specify the schedule that pulls the metadata into the asset. 1. Choose **Next**. 1. Choose **Create**. 1. (Optional) If you haven't created a schedule, choose **Run** to bring the metadata from the AWS Glue table into the asset. ------ #### [ Publish an Amazon Redshift table ] To publish an asset for an Amazon Redshift table, you create a data source for it and publish it. A data source is the mechanism that pulls the metadata from the Amazon Redshift table into the asset. Use the following procedure to publish an Amazon Redshift table. **To publish an Amazon Redshift table** 1. Navigate to the **SageMaker Assets** landing page. 1. Select **Owned assets**. 1. Choose **View data sources**. 1. Choose **Create data source**. 1. For **Name**, specify a name for the data source. 1. For **Description**, provide a description. 1. For **Type**, select **Amazon Redshift**. 1. + Select **Redshift cluster**. 1. For **Redshift cluster**, specify the name of the Amazon Redshift cluster containing the database for the table. 1. For **Secret**, specify the name of the AWS Secrets Manager secret containing the credentials for the cluster. + Select **Redshift serverless**. 1. For **Redshift workgroup**, specify the name of the Amazon Redshift workgroup containing the database for the table. 1. For **Secret**, specify the name of the AWS Secrets Manager secret containing the credentials for the workgroup. 1. For **Publish source selection**, select the database containing the Amazon Redshift table. 1. For **Table selection criteria**, specify the name of the table. **Note** Even though you can specify more than one table, we strongly suggest providing only one table name. 1. Choose **Next**. 1. + For **Publish asset to the catalog**, select **Yes** to publish to the asset catalog. + For **Publish asset to the catalog**, select **No** to publish to the asset catalog. 1. Choose **Next**. 1. Under **Asset details**, choose **Run on a schedule** or **Run on demand** to determine how the metadata from the Amazon Redshift table is pulled into the asset. 1. (Optional) If you choose **Run on a schedule**, specify the schedule that pulls the metadata into the asset. 1. Choose **Next**. 1. Choose **Create**. 1. (Optional) If you haven't created a schedule, choose **Run** to bring the metadata from the Amazon Redshift table into the asset. ------ Use the following procedures to publish an asset for a feature group or model package group. ------ #### [ Publish a feature group ] Use the following procedure to navigate to a feature group that you've created and publish it to your owned assets or asset catalog. **To publish the feature group to your owned assets or asset catalog** 1. Within Studio, select **Data** on the left hand navigation. 1. Select the feature group that you're publishing. 1. Choose the ![\[\]](http://docs.aws.amazon.com/sagemaker/latest/dg/images/sm-assets-publish-icon.png) icon. 1. + Select **Publish to asset catalog** to publish to the asset catalog. + Select **Publish to inventory** to publish to the owned assets of your group. ------ #### [ Publish a model group ] Use the following procedure to navigate to a model group that you've created and publish it to your owned assets or asset catalog. **To publish the model group to your owned assets or asset catalog** 1. Within Studio, select **Models** on the left hand navigation. 1. Select the model group that you're publishing. 1. Choose the ![\[\]](http://docs.aws.amazon.com/sagemaker/latest/dg/images/sm-assets-publish-icon.png) icon. 1. + Select **Publish to asset catalog** to publish to the asset catalog. + Select **Publish to inventory** to publish to the owned assets of your group. ------ Use the following procedure to publish an asset from your owned assets to the asset catalog. **To publish an asset from the SageMaker Assets page** 1. Within Studio, navigate to **Assets**. 1. Select **Owned assets**. 1. Specify the name of your asset in the search bar. 1. Choose the asset. 1. Choose **Publish**. You can use the following SageMaker Python SDK code to publish a feature group or model package group. The code assumes that you've already created the feature group or model package group. ``` from sagemaker.asset import AssetManager publisher = AssetPublisher() publisher.publish_to_catalog(name-of-your-feature-group-or-model-package) ``` ## Step 3: Manage access requests After you've published an asset, users outside of your project might want to access it. You can provide, reject, or revoke access requests. You can also delete assets to only make the underlying source of data only available to yourself. Use the following procedure to respond to subscription requests. **To approve subscription requests** 1. Navigate to the **SageMaker Assets** page. 1. Choose **Manage asset assets**. 1. Select **Incoming subscription requests**. 1. + (Optional) Choose **Approve** and provide reason. + (Optional) Choose **Reject**. You can revoke access to an asset that you've previously approved. If you choose to revoke access, users lose access to both the asset and the underlying asset. source. Use the following procedure to revoke access. **To revoke access** 1. Navigate to the **SageMaker Assets** page. 1. Choose **Manage asset assets**. 1. Select **Incoming subscription requests**. 1. Select the **Approved** tab. 1. Choose **Revoke** next to the asset. You can also unpublish assets, making them only show up as owned assets. The assets won't be visible in the resouce catalog, but the individuals whose subscription requests you've approved can still access them. **To unpublish an asset** 1. Navigate to the **SageMaker Assets** page. 1. Under **Owned assets**, select the asset that you're unpublishing. 1. Choose **Unpublish**. You can also delete assets from the same page where you unpublish them. Deleting an asset doesn't delete the source of data. Asset deletion only makes the asset invisible to the other members of your project or organization. ## Step 4: Find assets and request access to them You can request access to assets that other users have published to the resource catalog. If they approve the subscription request, you get access to the underlying source of data. At the top of the SageMaker Assets page, you can specify a search query to find assets that other users in your organization have published. You can also select an asset type to view all the published assets of that type. For example, you can select **Glue Table** to view all of the published AWS Glue tables. You can also view the asset type directly under the name of the asset. The following are the available names for the asset types: + Redshift table + Glue table + Models + Feature group **Note** Feature groups in the following stores have the type of **Glue table**: Offline Offline and online **To make a subscription request** 1. Navigate to the **SageMaker Assets** page. 1. + In the search bar, specify the name of the asset and choose **Search**. + For **Types**, select the asset type and find an asset that you're accessing within the resource catalog. 1. Choose the asset. 1. Choose **Subscribe**. 1. Provide a reason for the request. 1. Choose **Submit**. Your subscription request appears under **Outgoing subscription requests** under **Manage asset requests**. If the publisher of the asset approves your request, it appears under **Subscribed assets**. You can now use the Amazon Redshift, AWS Glue table, or ML source of data in your machine learning workflows. ## Step 5: Use a shared asset in your machine learning workflows If your subscription request to an asset is approved, you can use it in your machine learning workflows. The feature groups to which you've been given access appear in your list of feature groups in Studio. The model groups to which you've been given access appear in your list of model groups in Studio. You can open your model group in model registry from SageMaker Assets. Use the following procedure to open the model group within model registry. **Subscribed assets**. **To open a model group from SageMaker Assets** 1. Select the model group. 1. Choose **Open in Model Registry**. You can access AWS Glue or Amazon Redshift tables in Data Wrangler within SageMaker Canvas. SageMaker Canvas is an application that lets you perform exploratory data analysis (EDA) and train models without code. For more information about SageMaker Canvas, see [Amazon SageMaker Canvas](canvas.md). You can also bring the data from your AWS Glue or Amazon Redshift tables into your Jupyter notebooks by using the SQL extension. You can convert your data into pandas dataframes for your machine learning workflows. For more information, see [Data preparation with SQL in Studio](sagemaker-sql-extension.md).