Credentials for the connection

Decide how you want to configure access between watsonx.governance and Amazon SageMaker. You can use a cross-account role or access keys.

• To use a cross-account role, see Setting up a cross-account role.
• To use access keys, see Setting up access keys.

Accounts

Each connection to Amazon SageMaker is to an account that owns a centralized model registry. You can connect to a maximum of ten different accounts, each with a model registry. For more information about using more than a single central model registry, see Guidance for Multi-Account Machine Learning Model Governance on AWS.

Business entities

Decide which business entities you want to use. You need a separate business entity for each Amazon SageMaker connection that you configure. This business entity must be at the root level, and not a child of any other business entity. Only use cases under the configured business entity, along with their associated model groups and models, are governed by watsonx.governance and Amazon SageMaker.

The business entity is the parent of the use cases, but it doesn't need to be the primary parent. You can use the business entity for other purposes.

Users must select the business entity when they create use cases. Ensure that your users know which business entity to use. Also, ensure that use case approvers verify that the business entity is set correctly before they approve a use case. If the business entity is not set correctly before a use case is approved, the use case and its child model groups and models won't sync with Amazon SageMaker.

For example, if a user selects a child of the business entity that you configured and the use case is approved, the synchronization job doesn't sync the use case to Amazon SageMaker.

To help users, use security domains to give the access to the specific business entities that they need.

Do the following steps:

1. For each connection, decide which business entity to use. If you want to use a new business entity, create it before you configure the connection to Amazon SageMaker. To create a business entity, you must have administrative permissions.
2. In the Governance console, give users access to the security domain for the business entity. For example, create a group, add users to the group, and then associate the group with the business entity's security domain. For more information, see Security domains.

Default profile and default user

For each connection, you need a default profile and a default user.

The default profile is used to generate the pre-signed links in task views. These links open Amazon SageMaker by using the default profile. Give the default profile the minimum access rights that are needed by the governance users to get more information about model groups and models in Amazon SageMaker.

The pre-signed link is valid for five minutes. After that time, users need to refresh the task view to regenerate the link.

The default user is used in the following cases:

• When a model doesn't have an assigned owner, the model owner is set to this default user.
• When the owner of a model doesn't have an account in the Governance console, the model owner is set to this default user.

Setting up a cross-account role

This task is required if you want to use a cross-account role to integrate Amazon SageMaker with watsonx.governance. For more information, see Cross account resource access in IAM.

To set up the cross-account role, do the following steps:

1. Generate an External ID for the AWS account.
2. Attach the following policies to the role: AmazonSageMakerFullAccess and AmazonSQSFullAccess.
3. Add the External ID to the trust policy of the role.

Setting up an access key

Do this task if you want to use access keys to connect Amazon SageMaker with watsonx.governance.

In AWS, set up a long-term access key for the integration with watsonx.governance. Your credentials must have the following access:

• Programmatic access to Simple Queue service (SQS)
• Programmatic access to the Amazon SageMaker APIs
• Permissions to update model cards in Amazon SageMaker

For more information, see AWS security credentials.

Setting up an SQS queue

The integration uses an SQS queue to receive notifications for any changes in models groups and models.

For each connection, set up an SQS queue in the account.

To set up an SQS queue, do the following steps:

1. From the AWS console, select the Simple Queue Service.
2. Click Create Queue.
3. Type a name for the queue, and then enter the following information:
   • Type: FIFO
   • Visibility timeout: 30 seconds
   • Message retention period: 4 days
   • Maximum message size: 256 KB
   • Delivery delay: 0
   • Receive message wait time: 0
4. Under FIFO queue settings, enable the following options:
   • Content-based deduplication
   • High throughput FIFO queue

The SQS queue is defined. Next, set up an EventBridge rule.

Setting up an EventBridge rule

To set up an EventBridge rule and add your SQS queue as a target, do the following steps:

1. From the AWS console, select the Amazon EventBridge service.
2. Click Create Rule.
3. Type a name for the rule, and then click Next.
4. For the event source, click Other.
5. For the creation method, click Custom pattern (JSON editor), and then enter the following JSON for Event pattern:

   {
      "source": ["aws.sagemaker"],
      "detail-type": ["AWS API Call via CloudTrail"],
      "detail": {
       "eventSource": ["sagemaker.amazonaws.com"],
       "eventName": ["CreateModelPackage", "CreateModelPackageGroup"
       "DeleteModelPackage", "DeleteModelPackageGroup", "UpdateModelPackage"]
      }
   }
   

6. Click Next.
7. Set the target to the SQS queue that you created.
8. Click Next on the remaining pages, and then click Create Rule.

You now have an EventBridge rule with your SQS queue as the target of the rule.