Deepgram integrates AWS IAM temporary delegation for SageMaker support access

Amazon SageMaker AI provides a managed control plane for deploying Deepgram speech models inside a customer's own AWS account. The platform offers AWS Marketplace listings for Deepgram's Nova, Flux, and Aura-2 models (covering both speech-to-text and text-to-speech), validated reference architectures for VPC isolation and auto-scaling, and Terraform modules that platform teams can integrate into their existing infrastructure. This approach closes the gap between self-hosting—which enterprises choose for data residency, network isolation, and regulatory compliance—and the operational maturity of a managed cloud service.

Production deployments inevitably require support. A model returns unexpected results, an endpoint autoscales slower than expected, or GPU utilization looks off. The engineer best positioned to diagnose the issue is on the Deepgram team, but they have no access to the customer's Amazon VPC. The traditional options all had drawbacks: long-lived cross-account IAM roles required customers to provision, audit, and revoke them repeatedly; shared screens and copy-pasted logs were slow and error-prone, and unsuitable for regulated environments; asking customers to run commands on Deepgram's behalf did not scale for iterative troubleshooting.

IAM temporary delegation, a new AWS IAM capability, solves this by allowing partners to request scoped, time-limited, customer-approved access to specific resources with no long-lived credentials, no cross-account roles, and no shared secrets. The workflow is built directly into Deepgram's support ticketing system. A Deepgram engineer runs the /delegate_access command in the customer support ticket, the customer replies with their SageMaker AI endpoint ARN, and the integration calls iam:CreateDelegationRequest with a pre-registered DeepgramSageMakerReadOnlyTroubleshooting permission template. The customer opens a deep link to their IAM console, reviews the fully resolved permissions (with every resource ARN spelled out and no wildcards), and chooses Approve to grant read-only access to exactly one CloudWatch log group and one DescribeEndpoint resource. AWS then issues short-lived STS credentials scoped to the template and bounded by a twelve-hour SessionDuration. The credentials are posted to the ticket's internal discussion, and every API call made with them is tagged in the customer's AWS CloudTrail with Deepgram's partner account ID. The customer can revoke access at any time before expiration.

The integration has reduced the time for initial investigation on a SageMaker AI support ticket from days—previously requiring a screen-share scheduled across both calendars—to minutes. For Deepgram's security-conscious enterprise buyers, it replaces a recurring IAM role provisioning conversation with a no-standing-access posture that is strictly stronger than the alternative. Customers running this integration incur AWS charges for SageMaker AI endpoint hosting (including GPU instances), Amazon CloudWatch logs, AWS CloudTrail, and associated networking resources. Deepgram offers a 14-day trial at no additional cost for its models, but AWS infrastructure costs apply from the start of deployment.

Deepgram's self-hosted deployment on Amazon SageMaker AI addresses a core enterprise requirement: running speech AI models within a customer's own AWS account for data residency, network isolation, and regulatory compliance—without sacrificing the operational maturity of a managed cloud service. The body describes how Deepgram has invested across three dimensions: AWS Marketplace listings with one-click subscription, validated reference architectures covering VPC isolation and auto-scaling, and Terraform modules that platform teams can layer onto existing infrastructure.

The support access problem solved by IAM temporary delegation reflects a tension at the heart of self-hosted deployments. When a model misbehaves or an endpoint autoscales unexpectedly, the engineer best positioned to diagnose the issue is often on the Deepgram side—but that engineer has no access to the customer's VPC. The traditional remedies all carried operational costs: long-lived cross-account IAM roles required recurring audit and revocation conversations; screen-shares and copy-pasted logs were slow and audit-unfriendly; asking customers to run commands on behalf of Deepgram did not scale. IAM temporary delegation addresses all three drawbacks by issuing scoped, time-limited credentials directly in the customer's IAM console, with every action tagged for audit and zero standing trust between accounts.

No comments yet. Be the first to share your thoughts!