How ZS democratized secure ad-hoc analytics with Amazon SageMaker

Organizations in regulated industries often face the challenge of enabling rapid, ad-hoc analytics while maintaining strict compliance standards. ZS Associates addressed this by building a secure, multi-tenant Amazon SageMaker platform tailored to their healthcare sector requirements. The platform supports over 1,000 daily active users across more than 200 SageMaker domains, combining robust security measures with developer flexibility.

The architecture is designed to operate in an internet-free mode by default, utilizing Amazon Virtual Private Cloud (VPC) endpoints for controlled AWS service communication. It incorporates a multi-tenant setup with isolated SageMaker domains, each with dedicated storage, IAM roles, and network settings, ensuring strong data separation and access control.

To enforce security and compliance, ZS integrated AWS Key Management Service (KMS) encryption across all resources, and employed CrowdStrike and Splunk for threat detection and log management, respectively. Cost management is achieved through tag-based allocation, auto-shutdown policies, and Savings Plans, resulting in significant savings and efficient resource utilization.

The platform's governance is further reinforced by fine-grained IAM policies restricting access to specific SageMaker features based on user roles. Custom implementations include automated backups of SageMaker Spaces data to Amazon S3, managed package installation via JFrog Artifactory, and the addition of R kernel support within SageMaker.

ZS also developed self-service tools using Streamlit, enabling users to manage Redshift clusters, query S3 data, and provision EMR clusters directly within SageMaker Spaces. Monitoring tools provide visibility into resource utilization at the Space level, supporting capacity planning and cost control.

These enhancements have transformed SageMaker into a self-service analytics platform that meets the needs of regulated environments without compromising security or compliance. The platform's success is reflected in its widespread adoption across ZS's application teams, its operational efficiency, and its cost-effectiveness, demonstrating that developer agility and strict governance can coexist effectively.