Deepgram has integrated with AWS IAM temporary delegation to improve support for its speech AI models running on Amazon SageMaker AI. This integration allows partners to gain scoped, time-limited access to specific resources without long-lived credentials or cross-account roles. The change streamlines the support process, reducing the time needed to investigate issues from days to minutes. Previously, support required scheduling screen shares across customer and partner calendars, which was slow and error-prone. With the new system, customers approve access requests in their own IAM console, ensuring auditability and reducing cross-account access concerns. The integration is part of Deepgram’s broader effort to provide a managed deployment option for self-hosted speech AI models. It builds on Amazon SageMaker AI, which offers a single AWS-native control plane for deploying, scaling, and observing Deepgram speech models within the customer’s own account. This approach maintains the operational benefits of a managed cloud service while allowing customers to retain control over their data and infrastructure. The integration is designed to address the challenges of supporting models running in customer Amazon VPCs, where traditional access methods are limited. By leveraging IAM temporary delegation, Deepgram enables engineers to diagnose issues without compromising security or auditability. The process involves a customer approving a delegation request in their IAM console, which grants access to specific resources for a bounded period. The system automatically revokes access after twelve hours, ensuring that no long-lived credentials are used. This approach aligns with the operational maturity expected in enterprise environments, where auditability and control are paramount. The integration is part of a broader effort to provide self-hosted customers with a seamless experience that does not require them to be 'on their own.'
Deepgram’s integration with IAM temporary delegation is a response to the support challenges faced by customers running self-hosted speech AI models. When a model returns unexpected results or an endpoint misbehaves, the engineer best positioned to diagnose the issue is often on the partner side. However, traditional methods of granting access, such as long-lived cross-account IAM roles, are operationally expensive and raise audit concerns. Shared screens and copy-pasted logs are slow and error-prone, especially in regulated environments where every command must be attributable. Asking the customer to run commands on Deepgram’s behalf works for trivial issues but does not scale for more complex problems. The need for a solution that provides scoped, auditable access to exactly one SageMaker AI endpoint, with the customer in control of approval and no standing trust between accounts, led to the integration of IAM temporary delegation. This approach eliminates the need for long-lived credentials, cross-account roles, and shared secrets, aligning with the security expectations of enterprise customers.
The support access problem is a critical challenge for customers running self-hosted speech AI models on Amazon SageMaker AI. When a model returns unexpected results or an endpoint misbehaves, the engineer best positioned to diagnose the issue is often on the Deepgram team. However, they face the challenge of investigating a workload running inside a customer’s Amazon VPC without access. Traditional options, such as long-lived cross-account IAM roles, have drawbacks, including the need for customers to provision, audit, and revoke them, and for platform teams to answer for them during audits. Shared screens and copy-pasted logs are slow, error-prone, and a poor fit for regulated environments where every command must be attributable. Asking the customer to run commands on Deepgram’s behalf works for trivial issues but does not scale for more complex problems. The integration of IAM temporary delegation provides a solution by granting scoped, auditable access to exactly one SageMaker AI endpoint for a bounded window, with the customer in control of the approval and no standing trust between accounts. This approach ensures that no long-lived credentials are used, and access is automatically revoked after twelve hours, maintaining security and auditability.
Source: awsml
