Optimizing Data Access with Amazon S3 Access Grants and SageMaker Studio

Amazon SageMaker Studio offers a unified web-based interface for data scientists, ML engineers, and developers to create, train, debug, deploy, and monitor their ML models. These individuals often need access to data stored in Amazon Simple Storage Service (Amazon S3) for various tasks such as model training and artifact storage.

Traditionally, access to data in Amazon S3 from SageMaker Studio was managed through roles configured at the domain or user profile level. While this allowed for some flexibility, it also required frequent updates to role policies as access requirements changed, leading to maintenance overhead.

Enter Amazon S3 Access Grants, a feature that simplifies data access by providing dynamic access management without the need to constantly update IAM roles. S3 Access Grants allow data owners or administrators to set permissions at different levels of Amazon S3, granting read-only, write-only, or read/write access to IAM principals or corporate directory users and groups integrated with AWS IAM Identity Center.

In this article, we demonstrate how to streamline data access to Amazon S3 from SageMaker Studio using S3 Access Grants, specifically for different user personas using IAM principals.

Solution Overview

Consider a scenario where a product team with two members, User A and User B, requires access to an S3 bucket with specific access requirements:

• All team members should have access to the “Product” folder within the bucket.
• User A should only access the “UserA” folder.
• User B should only access the “UserB” folder.
• User A will run an Amazon SageMaker Processing job that utilizes S3 Access Grants to retrieve data from the bucket using temporary credentials provided by the grants.

Refer to the diagram below to visualize the solution architecture and workflow:

Let’s start by creating a SageMaker Studio environment tailored to our scenario. This includes setting up a SageMaker Studio domain, configuring user profiles for User A and User B, establishing an S3 bucket with necessary folders, and configuring S3 Access Grants.

Prerequisites

Before configuring the SageMaker Studio environment and S3 Access Grants, ensure you have administrative privileges for the AWS account. If not, seek assistance from someone with the necessary permissions. Throughout this post, we assume you can create SageMaker Studio domains, S3 buckets, and configure S3 Access Grants. Consult with your AWS administrator for guidance if needed.

Clean Up

To prevent future charges, delete the CloudFormation stack to remove resources like the SageMaker Studio domain, S3 Access Grants instance, and S3 bucket.

Conclusion

In conclusion, controlling data access to Amazon S3 from SageMaker Studio with S3 Access Grants provides a flexible and scalable method to define access patterns at scale. S3 Access Grants offer more granular control than traditional IAM-based techniques, supporting IAM principals and direct granting of access to users and groups from a synced corporate directory.

Integrate S3 Access Grants into your AWS environment alongside SageMaker Studio for a streamlined data management workflow. Leverage the granular access control and scalability of S3 Access Grants to facilitate collaboration, secure data access, and simplified access management in the SageMaker Studio environment.

About the Authors

Koushik Konjeti is a Senior Solutions Architect at Amazon Web Services. His passion lies in aligning architectural guidance with customer goals and tailoring solutions to meet unique requirements. Outside of work, he enjoys playing cricket and tennis.

Vijay Velpula is a Data Architect with AWS Professional Services. He specializes in helping customers implement Big Data and Analytics Solutions. Outside of work, he enjoys spending time with family, traveling, hiking, and biking.

Ram Vittal is a Principal ML Solutions Architect at AWS with over 30 years of experience building distributed, hybrid, and cloud applications. He is dedicated to creating secure, scalable AI/ML and big data solutions to assist enterprise customers in their cloud adoption journey. In his free time, he enjoys motorcycle rides and nature adventures with family.