How ZS democratized secure ad-hoc analytics with Amazon SageMaker
aws ·
ZS Associates built a security-hardened Amazon SageMaker environment to balance developer agility with strict governance in a regulated healthcare setting. The platform uses a multi-tenant architecture with separate SageMaker domains per tenant, isolated storage, IAM role hierarchies, and encryption by default. It runs in internet-free mode with Amazon VPC endpoints and routes all package installations through JFrog Artifactory for scanning. Custom lifecycle configurations provide automated backups to Amazon S3, enforce cost controls with pre-approved instance types, and shut down idle resources. The rollout includes 200+ SageMaker domains and 500+ daily active users, with SageMaker becoming the primary ad-hoc analytics tool for most application teams. ZS reports over $50K in monthly SageMaker spend, with Savings Plans saving about $10K per month. Additional custom tools include Streamlit self-service applications, an R kernel, S3 browser integration, and Space-level monitoring via CloudWatch. These measures deliver quantifiable benefits in operational efficiency, security compliance, cost optimization, and governance at scale.
aws