Use Amazon SageMaker {custom} tags for venture useful resource governance and value monitoring

Amazon SageMaker introduced a brand new function that you should utilize so as to add {custom} tags to sources created by way of an Amazon SageMaker Unified Studio venture. This helps you implement tagging requirements that conform to your group’s service management insurance policies (SCPs) and helps allow value monitoring reporting practices on sources created throughout the group.

As a SageMaker administrator, you’ll be able to configure a venture profile with tag configurations that will likely be pushed all the way down to tasks that at the moment use or will use that venture profile. The venture profile is ready as much as go both required key and worth tag pairings or go the important thing of the tag with a default worth that may be modified throughout venture creation. All tags handed to the venture will outcome within the sources created by that venture being tagged. This offers you with a governance mechanism that enforces that venture sources have the anticipated tags throughout all tasks of the area.

The primary launch of {custom} tags for venture sources is supported by way of an utility programming interface (API), by way of Amazon DataZone SDKs. On this submit, we take a look at use instances for {custom} tags and the right way to use the AWS Command Line Interface (AWS CLI) so as to add tags to venture sources.

What we hear from clients

As clients proceed to construct and collaborate utilizing AWS instruments for mannequin growth, generative AI, knowledge processing, and SQL analytics, they see the necessity to convey management and visibility into the sources being created. To assist connectivity to those AWS instruments from SageMaker Unified Studio tasks, many several types of sources throughout AWS providers should be created. These sources are created by way of AWS CloudFormation stacks (by way of venture setting deployment) by the Amazon SageMaker service. From clients we hear the next use instances:

• Clients must implement that tagging practices conform to firm insurance policies by way of the usage of AWS controls, akin to SCPs, for useful resource creation. These controls block the creation of sources until particular tags are positioned on the useful resource.
• Clients may begin with insurance policies to implement that the proper tags are positioned when sources are created with the extra aim of standardizing on useful resource reporting. By inserting identifiable data on sources when created, they implement consistency and completeness when performing value attribution reporting and observability.

Buyer Swiss Life makes use of SageMaker as a single answer for cataloging, discovery, sharing, and governance of their enterprise knowledge throughout enterprise domains. They require all sources have a set of necessary tags for his or her finance group to invoice organizations throughout their firm for the AWS sources created.

“The launch of venture useful resource tags for Amazon SageMaker permits us to convey visibility to the prices incurred throughout our accounts. With this functionality we’re in a position to meet the useful resource tagging tips of our firm and trust in attributing prices throughout our multi-account setup for the sources created by Amazon SageMaker tasks.”

– Tim Kopacz, Software program Developer at Swiss Life

Stipulations

To get began with {custom} tags, you have to have the next sources:

• A SageMaker Unified Studio area.
• An AWS Id and Entry Administration (IAM) entity with privileges to make AWS CLI calls to the area.
• An IAM entity licensed to make modifications to the area IAM provisioning function. If SageMaker created this for you, will probably be known as AmazonSageMakerProvisioning-. The provisioning function provisions and manages sources outlined within the chosen blueprints in your account.

How you can arrange venture useful resource tags

The next steps define how one can configure {custom} tags to your SageMaker Unified Studio venture sources:

1. (Elective) Replace the SageMaker provisioning function to allow particular tag keys.
2. Create a brand new venture profile with venture useful resource tags configured.
3. Create a brand new venture with venture useful resource tags.
4. Replace an present venture with venture useful resource tags.
5. Validate that the sources are tagged.

(Elective) Replace a SageMaker provisioning function to allow tag key values

The AmazonSageMakerProvisioning- function has an AWS managed coverage with situation aws:TagKeys permitting tags to be created by this function provided that the tag key begins with AmazonDataZone. For this instance, we’ll change the tag key to start with totally different strings. Skip to Create a brand new venture profile with venture useful resource tags configured if you happen to don’t want tag keys to have a special construction (akin to begins with, incorporates, and so forth)

1. Open the AWS Administration Console and go to IAM.
2. Within the navigation pane, select Roles.
3. Within the checklist, select AmazonSageMakerProvisioning-.
4. Select the Permissions tab.
5. Select Add permissions, after which select Create inline coverage.
6. Beneath Coverage editor, choose JSON.
7. Enter the next coverage. Add the strings beneath the situation aws:TagKeys. On this instance, tag keys starting with ACME or tag keys with the precise match of CostCenter will likely be created by the function.

   {
       "Model": "2012-10-17",
       "Assertion": [
           {
               "Sid": "CustomTagsUnTagPermissions",
               "Effect": "Allow",
               "Action": [
                   "codecommit:UntagResource",
                   "iam:UntagRole",
                   "logs:UntagResource",
                   "athena:UntagResource",
                   "redshift-serverless:UntagResource",
                   "scheduler:UntagResource",
                   "bedrock:UntagResource",
                   "neptune-graph:UntagResource",
                   "quicksight:UntagResource",
                   "glue:UntagResource",
                   "airflow:UntagResource",
                   "secretsmanager:UntagResource",
                   "lambda:UntagResource",
                   "emr-serverless:UntagResource",
                   "elasticmapreduce:RemoveTags",
                   "sagemaker:DeleteTags",
                   "ec2:DeleteTags"
               ],
               "Useful resource": "*",
               "Situation": {
                   "StringEquals": {
                       "aws:ResourceAccount": "${aws:PrincipalAccount}"
                   },
                   "ForAllValues:StringLike": {
                       "aws:TagKeys": [
                           "AmazonDataZone*",
                           "ACME*",
                           "CostCenter"
                       ]
                   },
                   "Null": {
                       "aws:ResourceTag/AmazonDataZoneProject": "false"
                   }
               }
           },
           {
               "Sid": "CustomTagsTaggingPermissions",
               "Impact": "Enable",
               "Motion": [
                   "cloudformation:TagResource",
                   "codecommit:TagResource",
                   "iam:TagRole",
                   "glue:TagResource",
                   "athena:TagResource",
                   "lambda:TagResource",
                   "redshift-serverless:TagResource",
                   "logs:TagResource",
                   "secretsmanager:TagResource",
                   "sagemaker:AddTags",
                   "emr-serverless:TagResource",
                   "neptune-graph:TagResource",
                   "bedrock:TagResource",
                   "elasticmapreduce:AddTags",
                   "airflow:TagResource",
                   "scheduler:TagResource",
                   "quicksight:TagResource",
                   "emr-containers:TagResource",
                   "logs:CreateLogGroup",
                   "athena:CreateWorkGroup",
                   "scheduler:CreateScheduleGroup",
                   "cloudformation:CreateStack",
                   "ec2:*"
               ],
               "Useful resource": "*",
               "Situation": {
                   "ForAnyValue:StringLike": {
                       "aws:TagKeys": [
                           "AmazonDataZone*",
                           "ACME*",
                           "CostCenter"
                       ]
                   },
                   "StringEquals": {
                       "aws:ResourceAccount": "${aws:PrincipalAccount}"
                   }
               }
           }
       ]
   }

It’s potential to scope down the particular AWS service tag and un-tag permissions based mostly on which blueprints or capabilities are getting used.

Create a brand new venture profile with venture useful resource tags configured

Use the next steps to create a brand new SQL Analytics venture profile with {custom} tags. The instance makes use of AWS CLI instructions.

1. Open the AWS CloudShell console.
2. Create a venture profile utilizing the next CLI command.
   1. The project-resource-tags parameter consists of key (tag key), worth (tag worth), and isValueEditable (boolean indicating if the tag worth will be modified throughout venture creation or replace).
   2. The allow-custom-project-resource-tags parameter set to true permits the venture creator to create further key-value pairs. The important thing wants to evolve to the inline coverage of the AmazonSageMakerProvisioning- function.
   3. The project-resource-tags-description parameter is an outline subject for venture useful resource tags. The max character restrict is 2,048. The outline must be handed in each time create-project-profile or update-project-profile is named.

   aws datazone create-project-profile 
     --name "SQL Analytics with Mission Useful resource Tags" 
     --description "Analyze your knowledge in SageMaker Lakehouse utilizing SQL" 
     --domain-identifier "$DOMAIN_ID" 
     --region "$REGION" 
     --status ENABLED 
     --project-resource-tags '[
       {
           "key": "ACME-Application",
           "value": "SageMaker",
           "isValueEditable": false
       },
       {
           "key": "CostCenter",
           "value": "123",
           "isValueEditable": true
       }
     ]' 
     --allow-custom-project-resource-tags 
     --environment-configurations '[
       {
           "name": "Tooling",
           "description": "Configuration for the Tooling Environment",
           "environmentBlueprintId": "",
           "deploymentMode": "ON_CREATE",
           "deploymentOrder": 0,
           "awsAccount": {
           "awsAccountId": "$ACCOUNT"
       },
       "awsRegion": {
           "regionName": "$REGION"
       },
           "configurationParameters": {
               "parameterOverrides": [
                   {
                       "name": "enableSpaces",
                       "value": "false",
                       "isEditable": false
                   },
                   {
                       "name": "maxEbsVolumeSize",
                       "isEditable": false
                   },
                   {
                       "name": "idleTimeoutInMinutes",
                       "isEditable": false
                   },
                   {
                       "name": "lifecycleManagement",
                       "isEditable": false
                   },
                   {
                       "name": "enableNetworkIsolation",
                       "isEditable": false
                   }
               ]
           }
       },
       {
           "identify": "Lakehouse Database",
           "description": "Creates databases in Amazon SageMaker Lakehouse for storing tables in S3 and Amazon Athena sources to your SQL workloads",
           "environmentBlueprintId": "",
           "deploymentMode": "ON_CREATE",
           "deploymentOrder": 1,
           "awsAccount": {
               "awsAccountId": "$ACCOUNT"
           },
           "awsRegion": {
           "regionName": "$REGION"
           },
           "configurationParameters": {
               "parameterOverrides": [
                   {
                       "name": "glueDbName",
                       "value": "glue_db",
                       "isEditable": true
                   }
               ]
           }
       },
       {
           "identify": "OnDemand RedshiftServerless",
           "description": "Lets you create an extra Amazon Redshift Serverless workgroup to your SQL workloads",
           "environmentBlueprintId": "",
           "deploymentMode": "ON_DEMAND",
           "awsAccount": {
           "awsAccountId": "$ACCOUNT"
           },
           "awsRegion": {
               "regionName": "$REGION"
           },
           "configurationParameters": {
               "parameterOverrides": [
                   {
                       "name": "redshiftDbName",
                       "value": "dev",
                       "isEditable": true
                       },
                       {
                       "name": "redshiftMaxCapacity",
                       "value": "512",
                       "isEditable": true
                       },
                       {
                       "name": "redshiftWorkgroupName",
                       "value": "redshift-serverless-workgroup",
                       "isEditable": true
                       },
                       {
                       "name": "redshiftBaseCapacity",
                       "value": "128",
                       "isEditable": true
                       },
                       {
                       "name": "connectionName",
                       "value": "redshift.serverless",
                       "isEditable": true
                       },
                       {
                       "name": "connectToRMSCatalog",
                       "value": "false",
                       "isEditable": false
                       }
                   ]
               }
           },
           {
               "identify": "OnDemand Catalog for Redshift Managed Storage",
               "description": "Lets you create further catalogs in Amazon SageMaker Lakehouse for storing knowledge in Redshift Managed Storage",
               "environmentBlueprintId": "",
               "deploymentMode": "ON_DEMAND",
               "awsAccount": {
               "awsAccountId": "$ACCOUNT"
               },
               "awsRegion": {
                   "regionName": "$REGION"
               },
               "configurationParameters": {
                   "parameterOverrides": [
                       {
                           "name": "catalogName",
                           "isEditable": true
                       },
                       {
                           "name": "catalogDescription",
                           "value": "RMS catalog",
                           "isEditable": true
                       }
                   ]
               }
           }
     ]'

This venture profile could have the tag ACME-Software = SageMaker positioned on all tasks related to the venture profile and can’t be modified by the venture creator. The tag CostCenter = 123 can have the worth modified by the venture creator as a result of the isValueEditable property is ready to true.

Grant permissions for customers to make use of the venture profile throughout venture creation. Within the Authorization part of the venture profile set both Chosen customers or teams or Enable all customers and teams.

Using the allow-custom-project-resource-tags parameter means the venture creator can add their very own tags (key-value pair). The important thing should conform to the situation examine within the coverage of the provisioning function (AmazonSageMakerProvisioning-). If the allow-custom-project-resource-tagsparameter is modified to false after a venture created tags, tags created by the venture will likely be eliminated in the course of the subsequent venture replace.

Updates to the venture profile

Updates to venture useful resource tags are potential by way of the update-project-profile command. The command will substitute all values within the project-resource-tags part so you’ll want to embrace the exhaustive set of tags. Updates to the venture profile are mirrored in tasks after working the update-project command or when a brand new venture is created utilizing the venture profile. The next instance provides a brand new tag, ACME-BusinessUnit = Retail.

There are 3 ways to work with the project-resource-tags parameter when updating the venture profile.

• Passing a non-empty checklist of venture useful resource tags will substitute the tags at the moment configured on the venture profile.
• Passing an empty checklist of venture useful resource tags will filter all beforehand configured tags:
  • --project-resource-tags '[]'
• Not together with the venture useful resource tag parameter will preserve beforehand configured tags as-is.

aws datazone update-project-profile 
  --domain-identifier "$DOMAIN_ID" 
  --identifier "$PROJECT_PROFILE_ID" 
  --region "$REGION" 
  --project-resource-tags '[
    {
        "key": "ACME-Application",
        "value": "SageMaker",
        "isValueEditable": false
    },
    {
        "key": "CostCenter",
        "value": "123",
        "isValueEditable": true
    },
    {
        "key": "ACME-BusinessUnit",
        "value": "Retail",
        "isValueEditable": false
    }
  ]'

Create a brand new venture with venture useful resource tags

The next steps stroll you thru creating a brand new venture that inherits tags from the venture profile and lets the venture creator modify one of many tag values.

1. Create a venture utilizing the next instance CLI command.
2. Modify the CostCenter tag worth utilizing the --resource-tags parameter. Tags configured on the venture profile the place the isValueEditable attribute is false will likely be pushed to the venture routinely.

   aws datazone create-project 
     --domain-identifier "$DOMAIN_ID" 
     --region "$REGION" 
     --name "$PROJECT_NAME" 
     --description "New venture with tags" 
     --project-profile-id "$PROJECT_PROFILE_ID" 
     --resource-tags '{
           "CostCenter": "456"
       }'

Replace present venture with venture useful resource tags

For present tasks related to the venture profile, you have to replace the venture for the brand new tags to be utilized.

1. Replace the venture utilizing the next instance CLI command.
2. On this state of affairs, an editable worth must be up to date and a brand new tag added. Tag CostCenter could have its default worth overwritten as “789” and the brand new ACME-Division = Finance tag will likely be added.

   aws datazone update-project 
     --domain-identifier "$DOMAIN_ID" 
     --identifier "$PROJECT_ID" 
     --project-profile-version "newest" 
     --region "$REGION" 
     --resource-tags '{
           "CostCenter": "789",
           "ACME-Division": "Finance"
       }' 

Mission degree tags (these not configured from the venture profile) should be handed throughout venture replace to be preserved. For tags with isValueEditable = true configured from the venture profile, any override beforehand set must be utilized or the worth will revert to the default from the venture profile.

Validating sources are tagged

Validate that tags are positioned appropriately. An instance useful resource that’s created by the venture is the venture IAM function. Viewing the tags for this function ought to present the tags configured from the venture profile.

1. Open SageMaker Unified Studio to get the venture function from the Mission particulars part of the venture. The function identify begins with datazone_usr_role_.
2. Open the IAM console.
3. Within the navigation pane, select Roles.
4. Seek for the venture IAM function.
5. Choose the Tags tab.
   
   

Conclusion

On this submit, we mentioned tagging associated use instances from clients and walked by way of getting began with {custom} tags in Amazon SageMaker to put tags on the sources created by the venture. By giving directors a strategy to configure venture profiles with standardized tag configurations, now you can assist guarantee constant tagging practices throughout all SageMaker Unified Studio tasks whereas sustaining compliance with SCPs. This function addresses two essential buyer wants: imposing organizational tagging requirements by way of automated governance mechanisms and enabling correct value attribution reporting throughout multi-service deployments.

To study extra, go to Amazon SageMaker, then get began with Mission useful resource tags.

In regards to the authors