QuestionQ194

Data Security and Governance

A company uses Amazon SageMaker AI for its machine learning (ML) workflows. The company is organized into several project groups that use sensitive data. The company needs to give the project groups the ability to discover available datasets across different AWS accounts. The solution must maintain access controls and track all data access for compliance purposes.

Which solution will meet these requirements with the LEAST operational overhead?

  • A Use Amazon SageMaker Assets to publish, discover, and request access to datasets through the asset catalog with approval workflows that track data access.
  • B Set up Amazon SageMaker Feature Store with cross-account access policies to automatically share data between AWS accounts without requiring approval workflows.
  • C Set up IAM roles for each project group with permissions to access all datasets across all AWS accounts. Use AWS CloudTrail to record data access activity.
  • D Create separate Amazon SageMaker Studio domains for each project group with isolated environments and no ability to share data between domains.
Explanation

SageMaker's asset catalog capability (part of SageMaker Catalog/Unified Studio) lets data producers publish datasets that consumers across accounts can discover and request access to through a subscription-based approval workflow, with all access requests and grants tracked for compliance. This directly satisfies cross-account discovery, governed access control, and auditability with minimal custom infrastructure, unlike manually managed IAM roles or isolated Studio domains that block sharing altogether. Learn more: Amazon SageMaker Catalog governance

Community Discussion

No comments yet. Be the first to start the discussion!