Key Facts
- Who: Global management consulting and technology firm ZS, in collaboration with Amazon Web Services (AWS).
- What: Deployment of a security-hardened Amazon SageMaker environment for ad-hoc analytics and machine learning (ML).
- Scale: Supports 1,000+ daily active users across more than 200 SageMaker domains.
- Security: Operates in "internet-free" mode with multi-tenant isolation and automated real-time package scanning.
- Cost: Monthly SageMaker expenditure exceeds $50,000, with approximately $10,000 in monthly savings achieved through SageMaker Savings Plans.
ZS has successfully implemented a security-hardened analytics platform using Amazon SageMaker to provide ad-hoc machine learning capabilities to more than 1,000 daily active users. According to a technical case study co-authored by ZS and AWS, the platform enables data scientists in highly regulated sectors, such as healthcare, to access sophisticated ML tools while maintaining strict compliance with industry governance standards. The solution addresses the traditional tension between developer agility and the restrictive security requirements necessary for handling sensitive data.
A Secure Foundation for Healthcare-Grade ML
To meet the rigorous demands of the healthcare sector, ZS built its enterprise ML operations (MLOps) on Amazon SageMaker Studio. The primary objective was to democratize access to ML capabilities across the organization without compromising on data protection.
The architecture is designed to run in an "internet-free" mode by default. This means that deployments operate without direct access to the public internet, relying instead on Amazon Virtual Private Cloud (Amazon VPC) endpoints to communicate with necessary AWS services. To manage software dependencies securely, ZS integrated JFrog Artifactory. This setup includes upward repository linking and real-time package scanning, which prevents unauthorized or tampered code from being introduced into the development environment.
Technical Architecture and Multi-Tenancy
The platform utilizes a multi-tenant architecture that assigns separate Amazon SageMaker domains to each tenant. According to the technical documentation, this design ensures strong isolation through several layers:
- Isolated Storage: Each domain maintains its own Amazon Elastic File System (Amazon EFS) volumes.
- Network Controls: Distinct network settings are applied per domain to prevent cross-tenant data leakage.
- Identity Management: ZS implemented a three-tier AWS Identity and Access Management (IAM) role structure to enforce the principle of least privilege.
The IAM hierarchy includes Domain Execution Roles as the default for users, Studio User Roles to provide fine-grained overrides, and Space Execution Roles to govern shared workspaces. This structure allows the organization to maintain operational flexibility while ensuring that users only have access to the resources required for their specific projects.
Data protection is further reinforced through mandatory encryption. ZS enabled AWS Key Management Service (AWS KMS) encryption across all platform resources. This includes Amazon EFS volumes, Amazon S3 buckets, Amazon Elastic Container Registry (ECR), and AWS CodeCommit repositories. Notably, ZS noted that their CodeCommit deployment was established prior to the service's closure to new customers in July 2024.
Enhancing Security through Automation and Integration
Beyond native AWS tools, ZS integrated third-party security solutions to provide deep visibility and threat detection. The platform uses CrowdStrike for operating system-level threat detection and Splunk for log aggregation. All API calls are logged via AWS CloudTrail to maintain a comprehensive audit trail for compliance purposes.
One of the most significant technical hurdles ZS addressed was the lack of a native backup capability in SageMaker. To solve this, the team developed a custom lifecycle configuration. This script automatically synchronizes user data and scripts to Amazon S3 at regular intervals, providing a resilient environment for data scientists without requiring them to manually manage their own backups.
Operational Efficiency and Cost Management
The scale of the deployment—spanning 200+ domains—required robust cost-control mechanisms. ZS uses IAM policies to restrict the majority of users to smaller, pre-approved instance types. If a data scientist requires high-performance compute resources, they must submit a separate allowlisting request to the internal analytics team.
To minimize waste, ZS implemented auto-shutdown configurations that release idle resources. The company also employs tag-based cost allocation, where every domain and resource is tagged by team and project. This allows for accurate chargeback models using AWS Cost Explorer.
According to internal cost tracking cited in the report:
- Monthly SageMaker spend exceeds $50,000.
- Use of SageMaker Savings Plans reduces costs by approximately $10,000 per month.
- Lifecycle policies effectively eliminate costs associated with idle resources.
Impact Section
The implementation has transformed SageMaker into the primary ad-hoc analytics tool for ZS's application teams. By balancing governance with accessibility, the firm has achieved:
- Scalable Democratization: Over 1,000 daily active users can now perform complex analytics in a self-service manner.
- Healthcare Compliance: The platform meets strict industry requirements for encryption at rest and in transit, network isolation, and auditability.
- Financial Transparency: Detailed tagging allows ZS to attribute costs directly to specific projects and teams, ensuring financial accountability.
- Developer Agility: Automated configurations for compliance and backups allow developers to focus on model building rather than infrastructure management.
What's Next
While ZS has successfully rolled out the platform to the majority of its application team members, no specific timeline for future feature expansions or additional service integrations was announced in the report. The current focus remains on maintaining the security-hardened environment for its existing 200+ SageMaker domains.