Amazon SageMaker Integration for AI Governance Models

You can integrate an instance of Amazon SageMaker with OneTrust to enable automatic mapping of model attributes from AWS into corresponding fields in OneTrust. This offers Data Scientists a workstream that is more efficient than manual data entry.

Overview Steps

Enable necessary roles with required permissions and policies
Create an AWS event that will get triggered when a model is created
Create AWS Lambda Function to send a trigger to OneTrust to create the Model record in AI Governance using Integrations
Run AWS Pipeline to create and register Model in a working Amazon SageMaker domain

Prerequisites

SageMaker studio domain enabled with the following AWS IAM policies to allow account access to SageMaker APIs:
- AmazonSageMakerFullAccess (ensure this is also attached under Other permissions policies).
- AmazonS3ReadOnlyAccess
- SagemakerEMRNoAuthProductWithStudio-sageemr
SageMaker user with the execution role text (e.g. arn:aws:iam::<your-account-id>:role/)
Allowed access to AWS Lambda with trusted relationship

Note:

For additional guidance, see Amazon SageMaker Studio Account for ML Workflows.

To create the integration

In the Integrations menu, select Gallery.

The Integration Gallery screen appears.
Use the search function to locate the Amazon SageMaker tile.
Click the tile.

The Gallery Details screen appears.
Click the Add button for Amazon SageMaker Model Registration.

The Add Workflow Name modal appears.
Complete the fields, then click the Create button.

The Integration Builder screen appears.

Note:
You can select None for the Credential field.
The Built-in Webhook Trigger action will look for the model details using the following sample body:
JSON
{ "name": "model-1", "version": "1" }
```
{
	"name": "model-1",
	"version": "1"
}
```
The POST Create an Object with Values Defined in the Request action will return the model's name, organization group ID, and version using our provided payload variables:
Save and activate the integration. Whenever a model is now created and registered, a log will captured for the integration trigger and expected model name.

To configure the Lamdba Function for OneTrust

In the AWS management console, navigate to Lambda > Functions.
Create a new function and provide a unique name.
Upload a compressed file containing the Lambda function in .py format.

Note:
Please contact your account representative to request access to these files.
Navigate to Lambda Function > Configuration > Environment variables to set the environment variable with the following key-value pair using the given webhook endpoint appended with the Authorization API key for the desired OneTrust environment.
CODE
Key: OT_URL Value: https://<environment>.app/integrationmanager/api/v1/webhook/<iD>?Authorization=Bearer <bearer-token>=
```
Key: OT_URL
Value: https://<environment>.app/integrationmanager/api/v1/webhook/<iD>?Authorization=Bearer <bearer-token>=
```
Note:
To learn how to create an Authorization API Key, see Managing OAuth 2.0 API Keys.

Navigate to EventsBridge to create a new rule with the following:

Note:

For additional guidance, see Creating Rules in Amazon EventBridge.


Field/Setting	Input
Name	Provide a unique name for this new rule.
Description	Provide an optional description for the rule purpose.
Event bus	Select default
Enable the rule on the selected event bus	Enable this setting.
Rule type	Select Rule with an event pattern

Click the Next button.
In the Event Source section, select AWS events or EventsBridge partner events.
For methods, select Use pattern form.
Click the Next button.
In the Event Pattern section, select the following:
Event source

AWS services

AWS service

SageMaker

Event type

SageMaker Model State Change

Then provide the following event pattern that will filter for matched events:
JSON
{ "source": ["aws.sagemaker"], "detail-type": ["SageMaker Model State Change"] }
```
{
    "source": ["aws.sagemaker"],
    "detail-type": ["SageMaker Model State Change"]
}
```
Note:
For additional guidance, see SageMaker Model Stage Change.
In the Target section, select AWS service as the Target type and then choose the Lambda function created previously as the target.
Finish by creating the rule. This lambda function is ready to pair with the OneTrust integration to create model objects in the application using Sagemaker.