Use Amazon SageMaker {custom} tags for mission useful resource governance and price monitoring

Amazon SageMaker introduced a brand new function that you should utilize so as to add {custom} tags to assets created via an Amazon SageMaker Unified Studio mission. This helps you implement tagging requirements that conform to your group’s service management insurance policies (SCPs) and helps allow price monitoring reporting practices on assets created throughout the group.

As a SageMaker administrator, you possibly can configure a mission profile with tag configurations that will probably be pushed right down to tasks that at the moment use or will use that mission profile. The mission profile is ready as much as cross both required key and worth tag pairings or cross the important thing of the tag with a default worth that may be modified throughout mission creation. All tags handed to the mission will end result within the assets created by that mission being tagged. This offers you with a governance mechanism that enforces that mission assets have the anticipated tags throughout all tasks of the area.

The primary launch of {custom} tags for mission assets is supported via an software programming interface (API), via Amazon DataZone SDKs. On this submit, we have a look at use circumstances for {custom} tags and methods to use the AWS Command Line Interface (AWS CLI) so as to add tags to mission assets.

What we hear from clients

As clients proceed to construct and collaborate utilizing AWS instruments for mannequin improvement, generative AI, knowledge processing, and SQL analytics, they see the necessity to convey management and visibility into the assets being created. To help connectivity to those AWS instruments from SageMaker Unified Studio tasks, many various kinds of assets throughout AWS providers should be created. These assets are created via AWS CloudFormation stacks (via mission atmosphere deployment) by the Amazon SageMaker service. From clients we hear the next use circumstances:

• Clients have to implement that tagging practices conform to firm insurance policies via using AWS controls, akin to SCPs, for useful resource creation. These controls block the creation of assets except particular tags are positioned on the useful resource.
• Clients may begin with insurance policies to implement that the proper tags are positioned when assets are created with the extra purpose of standardizing on useful resource reporting. By putting identifiable info on assets when created, they implement consistency and completeness when performing price attribution reporting and observability.

Buyer Swiss Life makes use of SageMaker as a single resolution for cataloging, discovery, sharing, and governance of their enterprise knowledge throughout enterprise domains. They require all assets have a set of obligatory tags for his or her finance group to invoice organizations throughout their firm for the AWS assets created.

“The launch of mission useful resource tags for Amazon SageMaker permits us to convey visibility to the prices incurred throughout our accounts. With this functionality we’re in a position to meet the useful resource tagging pointers of our firm and have faith in attributing prices throughout our multi-account setup for the assets created by Amazon SageMaker tasks.”

– Tim Kopacz, Software program Developer at Swiss Life

Conditions

To get began with {custom} tags, you should have the next assets:

• A SageMaker Unified Studio area.
• An AWS Id and Entry Administration (IAM) entity with privileges to make AWS CLI calls to the area.
• An IAM entity licensed to make adjustments to the area IAM provisioning function. If SageMaker created this for you, it will likely be known as AmazonSageMakerProvisioning-. The provisioning function provisions and manages assets outlined within the chosen blueprints in your account.

Find out how to arrange mission useful resource tags

The next steps define how one can configure {custom} tags in your SageMaker Unified Studio mission assets:

1. (Elective) Replace the SageMaker provisioning function to allow particular tag keys.
2. Create a brand new mission profile with mission useful resource tags configured.
3. Create a brand new mission with mission useful resource tags.
4. Replace an present mission with mission useful resource tags.
5. Validate that the assets are tagged.

(Elective) Replace a SageMaker provisioning function to allow tag key values

The AmazonSageMakerProvisioning- function has an AWS managed coverage with situation aws:TagKeys permitting tags to be created by this function provided that the tag key begins with AmazonDataZone. For this instance, we are going to change the tag key to start with totally different strings. Skip to Create a brand new mission profile with mission useful resource tags configured when you don’t want tag keys to have a distinct construction (akin to begins with, incorporates, and so forth)

1. Open the AWS Administration Console and go to IAM.
2. Within the navigation pane, select Roles.
3. Within the record, select AmazonSageMakerProvisioning-.
4. Select the Permissions tab.
5. Select Add permissions, after which select Create inline coverage.
6. Beneath Coverage editor, choose JSON.
7. Enter the next coverage. Add the strings beneath the situation aws:TagKeys. On this instance, tag keys starting with ACME or tag keys with the precise match of CostCenter will probably be created by the function.

   {
       "Model": "2012-10-17",
       "Assertion": [
           {
               "Sid": "CustomTagsUnTagPermissions",
               "Effect": "Allow",
               "Action": [
                   "codecommit:UntagResource",
                   "iam:UntagRole",
                   "logs:UntagResource",
                   "athena:UntagResource",
                   "redshift-serverless:UntagResource",
                   "scheduler:UntagResource",
                   "bedrock:UntagResource",
                   "neptune-graph:UntagResource",
                   "quicksight:UntagResource",
                   "glue:UntagResource",
                   "airflow:UntagResource",
                   "secretsmanager:UntagResource",
                   "lambda:UntagResource",
                   "emr-serverless:UntagResource",
                   "elasticmapreduce:RemoveTags",
                   "sagemaker:DeleteTags",
                   "ec2:DeleteTags"
               ],
               "Useful resource": "*",
               "Situation": {
                   "StringEquals": {
                       "aws:ResourceAccount": "${aws:PrincipalAccount}"
                   },
                   "ForAllValues:StringLike": {
                       "aws:TagKeys": [
                           "AmazonDataZone*",
                           "ACME*",
                           "CostCenter"
                       ]
                   },
                   "Null": {
                       "aws:ResourceTag/AmazonDataZoneProject": "false"
                   }
               }
           },
           {
               "Sid": "CustomTagsTaggingPermissions",
               "Impact": "Permit",
               "Motion": [
                   "cloudformation:TagResource",
                   "codecommit:TagResource",
                   "iam:TagRole",
                   "glue:TagResource",
                   "athena:TagResource",
                   "lambda:TagResource",
                   "redshift-serverless:TagResource",
                   "logs:TagResource",
                   "secretsmanager:TagResource",
                   "sagemaker:AddTags",
                   "emr-serverless:TagResource",
                   "neptune-graph:TagResource",
                   "bedrock:TagResource",
                   "elasticmapreduce:AddTags",
                   "airflow:TagResource",
                   "scheduler:TagResource",
                   "quicksight:TagResource",
                   "emr-containers:TagResource",
                   "logs:CreateLogGroup",
                   "athena:CreateWorkGroup",
                   "scheduler:CreateScheduleGroup",
                   "cloudformation:CreateStack",
                   "ec2:*"
               ],
               "Useful resource": "*",
               "Situation": {
                   "ForAnyValue:StringLike": {
                       "aws:TagKeys": [
                           "AmazonDataZone*",
                           "ACME*",
                           "CostCenter"
                       ]
                   },
                   "StringEquals": {
                       "aws:ResourceAccount": "${aws:PrincipalAccount}"
                   }
               }
           }
       ]
   }

It’s potential to scope down the precise AWS service tag and un-tag permissions primarily based on which blueprints or capabilities are getting used.

Create a brand new mission profile with mission useful resource tags configured

Use the next steps to create a brand new SQL Analytics mission profile with {custom} tags. The instance makes use of AWS CLI instructions.

1. Open the AWS CloudShell console.
2. Create a mission profile utilizing the next CLI command.
   1. The project-resource-tags parameter consists of key (tag key), worth (tag worth), and isValueEditable (boolean indicating if the tag worth may be modified throughout mission creation or replace).
   2. The allow-custom-project-resource-tags parameter set to true permits the mission creator to create further key-value pairs. The important thing wants to adapt to the inline coverage of the AmazonSageMakerProvisioning- function.
   3. The project-resource-tags-description parameter is an outline area for mission useful resource tags. The max character restrict is 2,048. The outline must be handed in each time create-project-profile or update-project-profile known as.

   aws datazone create-project-profile 
     --name "SQL Analytics with Challenge Useful resource Tags" 
     --description "Analyze your knowledge in SageMaker Lakehouse utilizing SQL" 
     --domain-identifier "$DOMAIN_ID" 
     --region "$REGION" 
     --status ENABLED 
     --project-resource-tags '[
       {
           "key": "ACME-Application",
           "value": "SageMaker",
           "isValueEditable": false
       },
       {
           "key": "CostCenter",
           "value": "123",
           "isValueEditable": true
       }
     ]' 
     --allow-custom-project-resource-tags 
     --environment-configurations '[
       {
           "name": "Tooling",
           "description": "Configuration for the Tooling Environment",
           "environmentBlueprintId": "",
           "deploymentMode": "ON_CREATE",
           "deploymentOrder": 0,
           "awsAccount": {
           "awsAccountId": "$ACCOUNT"
       },
       "awsRegion": {
           "regionName": "$REGION"
       },
           "configurationParameters": {
               "parameterOverrides": [
                   {
                       "name": "enableSpaces",
                       "value": "false",
                       "isEditable": false
                   },
                   {
                       "name": "maxEbsVolumeSize",
                       "isEditable": false
                   },
                   {
                       "name": "idleTimeoutInMinutes",
                       "isEditable": false
                   },
                   {
                       "name": "lifecycleManagement",
                       "isEditable": false
                   },
                   {
                       "name": "enableNetworkIsolation",
                       "isEditable": false
                   }
               ]
           }
       },
       {
           "identify": "Lakehouse Database",
           "description": "Creates databases in Amazon SageMaker Lakehouse for storing tables in S3 and Amazon Athena assets in your SQL workloads",
           "environmentBlueprintId": "",
           "deploymentMode": "ON_CREATE",
           "deploymentOrder": 1,
           "awsAccount": {
               "awsAccountId": "$ACCOUNT"
           },
           "awsRegion": {
           "regionName": "$REGION"
           },
           "configurationParameters": {
               "parameterOverrides": [
                   {
                       "name": "glueDbName",
                       "value": "glue_db",
                       "isEditable": true
                   }
               ]
           }
       },
       {
           "identify": "OnDemand RedshiftServerless",
           "description": "Allows you to create a further Amazon Redshift Serverless workgroup in your SQL workloads",
           "environmentBlueprintId": "",
           "deploymentMode": "ON_DEMAND",
           "awsAccount": {
           "awsAccountId": "$ACCOUNT"
           },
           "awsRegion": {
               "regionName": "$REGION"
           },
           "configurationParameters": {
               "parameterOverrides": [
                   {
                       "name": "redshiftDbName",
                       "value": "dev",
                       "isEditable": true
                       },
                       {
                       "name": "redshiftMaxCapacity",
                       "value": "512",
                       "isEditable": true
                       },
                       {
                       "name": "redshiftWorkgroupName",
                       "value": "redshift-serverless-workgroup",
                       "isEditable": true
                       },
                       {
                       "name": "redshiftBaseCapacity",
                       "value": "128",
                       "isEditable": true
                       },
                       {
                       "name": "connectionName",
                       "value": "redshift.serverless",
                       "isEditable": true
                       },
                       {
                       "name": "connectToRMSCatalog",
                       "value": "false",
                       "isEditable": false
                       }
                   ]
               }
           },
           {
               "identify": "OnDemand Catalog for Redshift Managed Storage",
               "description": "Allows you to create further catalogs in Amazon SageMaker Lakehouse for storing knowledge in Redshift Managed Storage",
               "environmentBlueprintId": "",
               "deploymentMode": "ON_DEMAND",
               "awsAccount": {
               "awsAccountId": "$ACCOUNT"
               },
               "awsRegion": {
                   "regionName": "$REGION"
               },
               "configurationParameters": {
                   "parameterOverrides": [
                       {
                           "name": "catalogName",
                           "isEditable": true
                       },
                       {
                           "name": "catalogDescription",
                           "value": "RMS catalog",
                           "isEditable": true
                       }
                   ]
               }
           }
     ]'

This mission profile may have the tag ACME-Utility = SageMaker positioned on all tasks related to the mission profile and can’t be modified by the mission creator. The tag CostCenter = 123 can have the worth modified by the mission creator as a result of the isValueEditable property is ready to true.

Grant permissions for customers to make use of the mission profile throughout mission creation. Within the Authorization part of the mission profile set both Chosen customers or teams or Permit all customers and teams.

The usage of the allow-custom-project-resource-tags parameter means the mission creator can add their very own tags (key-value pair). The important thing should conform to the situation verify within the coverage of the provisioning function (AmazonSageMakerProvisioning-). If the allow-custom-project-resource-tagsparameter is modified to false after a mission created tags, tags created by the mission will probably be eliminated in the course of the subsequent mission replace.

Updates to the mission profile

Updates to mission useful resource tags are potential via the update-project-profile command. The command will exchange all values within the project-resource-tags part so be sure you embody the exhaustive set of tags. Updates to the mission profile are mirrored in tasks after working the update-project command or when a brand new mission is created utilizing the mission profile. The next instance provides a brand new tag, ACME-BusinessUnit = Retail.

There are 3 ways to work with the project-resource-tags parameter when updating the mission profile.

• Passing a non-empty record of mission useful resource tags will exchange the tags at the moment configured on the mission profile.
• Passing an empty record of mission useful resource tags will filter out all beforehand configured tags:
  • --project-resource-tags '[]'
• Not together with the mission useful resource tag parameter will maintain beforehand configured tags as-is.

aws datazone update-project-profile 
  --domain-identifier "$DOMAIN_ID" 
  --identifier "$PROJECT_PROFILE_ID" 
  --region "$REGION" 
  --project-resource-tags '[
    {
        "key": "ACME-Application",
        "value": "SageMaker",
        "isValueEditable": false
    },
    {
        "key": "CostCenter",
        "value": "123",
        "isValueEditable": true
    },
    {
        "key": "ACME-BusinessUnit",
        "value": "Retail",
        "isValueEditable": false
    }
  ]'

Create a brand new mission with mission useful resource tags

The next steps stroll you thru creating a brand new mission that inherits tags from the mission profile and lets the mission creator modify one of many tag values.

1. Create a mission utilizing the next instance CLI command.
2. Modify the CostCenter tag worth utilizing the --resource-tags parameter. Tags configured on the mission profile the place the isValueEditable attribute is false will probably be pushed to the mission mechanically.

   aws datazone create-project 
     --domain-identifier "$DOMAIN_ID" 
     --region "$REGION" 
     --name "$PROJECT_NAME" 
     --description "New mission with tags" 
     --project-profile-id "$PROJECT_PROFILE_ID" 
     --resource-tags '{
           "CostCenter": "456"
       }'

Replace present mission with mission useful resource tags

For present tasks related to the mission profile, you should replace the mission for the brand new tags to be utilized.

1. Replace the mission utilizing the next instance CLI command.
2. On this situation, an editable worth must be up to date and a brand new tag added. Tag CostCenter may have its default worth overwritten as “789” and the brand new ACME-Division = Finance tag will probably be added.

   aws datazone update-project 
     --domain-identifier "$DOMAIN_ID" 
     --identifier "$PROJECT_ID" 
     --project-profile-version "newest" 
     --region "$REGION" 
     --resource-tags '{
           "CostCenter": "789",
           "ACME-Division": "Finance"
       }' 

Challenge degree tags (these not configured from the mission profile) should be handed throughout mission replace to be preserved. For tags with isValueEditable = true configured from the mission profile, any override beforehand set must be utilized or the worth will revert to the default from the mission profile.

Validating assets are tagged

Validate that tags are positioned appropriately. An instance useful resource that’s created by the mission is the mission IAM function. Viewing the tags for this function ought to present the tags configured from the mission profile.

1. Open SageMaker Unified Studio to get the mission function from the Challenge particulars part of the mission. The function identify begins with datazone_usr_role_.
2. Open the IAM console.
3. Within the navigation pane, select Roles.
4. Seek for the mission IAM function.
5. Choose the Tags tab.
   

Conclusion

On this submit, we mentioned tagging associated use circumstances from clients and walked via getting began with {custom} tags in Amazon SageMaker to position tags on the assets created by the mission. By giving directors a approach to configure mission profiles with standardized tag configurations, now you can assist guarantee constant tagging practices throughout all SageMaker Unified Studio tasks whereas sustaining compliance with SCPs. This function addresses two crucial buyer wants: implementing organizational tagging requirements via automated governance mechanisms and enabling correct price attribution reporting throughout multi-service deployments.

To be taught extra, go to Amazon SageMaker, then get began with Challenge useful resource tags.

In regards to the authors