Onboarding SageMaker Partner AI Apps | Amazon Web Services

Key Takeaways

Hi, my name is Noful and I'm a specialist solution architect at Amazon Web Services. In this video, we'll do a brief overview of what are Amazon SageMaker partner AI apps and walk through how to onboard and configure them for your organization. This is the brief agenda of what we'll be walking through today. So, first we'll go over briefly what are SageMaker partner AI apps. Next, we'll go through some of the prerequisites for setting up the partner AAI apps, the permissions you'll require and the configuration. And then we'll do a brief walk through on how to actually provision these applications through the AWS console. So, first up, what are Amazon SageMaker partner AI apps? Through SageMaker partner apps, users get access to generative AI and machine learning development applications built, published, and distributed by industry-leading application providers. Partner AI apps are certified to run on SageMaker AI and SageMaker Unified Studio. With these applications, users can accelerate and improve how they build solutions based on foundation models and classical ML models without compromising the security of their sensitive data. The data stays completely within their trusted security configuration and is never shared with a third party. Now, we'll briefly go over the prerequisites required to set up the partner apps. Before you start, make sure your admin team has onboarded a SageMaker AI domain. Next, we'll need to set up some administrator permissions. In order for the SageMaker admins to be able to deploy SageMaker AI apps, they first must be able to subscribe to these apps via the AWS Marketplace. For this, you'll need to have the attached u manage policy AWS marketplace manage subscriptions to your admin role. Next, we need to set up a partner AI app execution role which is required for the app to interact with resources in the AWS account. A full detail of what these permissions are and how to set these up will be provided in a link in the video to the documentation page which has all the permissions required. After we've set up the admin permissions, we're going to set up the user permissions. These permissions are required so the users can access the deployed partner AI apps. These user permissions can be set up in a couple of different ways. First on the whole domain. So every user that can access that domain will have access to the SageMaker AI apps. And you do this by adding these user permissions to the SageMaker execution role of the domain. Alternatively, you could attach these user permissions on the individual user profiles. This will ensure that only specific users have access to these partner AI apps. For apps that are launched from studio unified studio, you need to also ensure that the SDS tag session trust policy is also applied to the execution rule. This will ensure that the identity of the users is propagated correctly. Partneri apps supports a few different methods of identity source. IM identity center, external identity providers or session based identity for full list of details of how these apply please check the documentation. Last up, if you are interacting via the SDK of the partner AI app, in order to access that functionality within SageMaker AI or through other methods such as pipelines, uh please add the call partner a app A API permissions to the role used to run the SDK code. Next up, we'll do a quick walkthrough on how to provision the SageMaker Partner AI apps after the prerequisites has been done. Okay, now we're going to set up partner apps through the AWS console. You start as the SageMaker admin within the SageMaker console. Here on the left, we will navigate to the partner AI apps section. You will see we'll the different options for the partner apps. We'll play pick one just for demonstration purposes today. Here we've selected Fiddler. You'll see that there are different uh options for the contract pricing uh with a 30-day free trial, the one month option, and the 12-month option, as well as the different infrastructure tier costs, which we'll come to in a second. First, in order to be able to deploy the application, we need to subscribe to it on the marketplace. So, we'll go to the marketplace page. Here we can choose the different options uh the purchase options where for today's purposes we're going to try the free trial. You can download the end user license agreement. Review that and once you're happy uh choose the right uh option. Here we choose the free trial but if you wanted to choose the paid option here are the options which um go through the different contract duration. if the auto renewal applies and so on. Once you're happy with the terms and conditions, you can subscribe to the application. This takes a few minutes and once it's done, we'll get the option to deploy the application. You'll see that you have successfully purchased uh the partner AI apps. And once that happens, you can click this button to be taken back to the SageMaker console to set up the application. Here you can configure the application for deployment. You can give it a name. Here we'll call it Fiddler. The next we choose a day where the application maintenance will occur. This is the time period during which AWS will apply updates uh security patches and so on. Uh and next for certain applications such as Fiddler and Comet, we need to provide an administrator user. This is an administrator within the application itself and not an admin of the AWS environment. So here we'll give it a name. Ensure that this name matches the identity of the admins because the identity will be propagated through to the applications through the SageMaker console. Next up, we'll choose the execution role that we created earlier and we'll attach this to the application and we'll enable either we want the STS identity propagation and we'll choose the tier for the application that we're deploying. This size of the deployment depends on your usage. As you can see, there are some guidelines provided in the description for you to pick which size of deployment applies to you. In this instance, we'll just pick the small option. After this, we'll go through the review section, review a few of the options, and then click deploy. After we've clicked the deploy button, it takes an hour or up to an hour and a half to actually deploy the application.