SageMaker MLflow Now Lets You Encrypt With Your Own Keys!

Hey everyone, it's me, Shiichan! Today's news is about giving your machine learning experiment tracking a lock only you hold the key to. Security folks, this one's for you.

AWS What's New aws.amazon.com

What was announced?

From AWS What's New: SageMaker MLflow now supports encryption with customer managed keys (CMK) through AWS Key Management Service (KMS). You can now encrypt your data using keys you provide yourself.

Why it matters

SageMaker MLflow already encrypted data, but key management was handled on AWS's side. Some organizations, though, need to manage their own encryption keys to meet compliance or security policy requirements. This update is aimed squarely at organizations with those strict security and compliance needs.

What changes

With customer managed keys, you get:

• Encryption of your MLflow data using your own KMS keys
• Integration with AWS CloudTrail, so you can trace all data access

In other words, you keep control over encryption while gaining an audit trail of who accessed your data and when. That's a real reassurance for organizations tracking sensitive data in their experiment management tooling.

Dive Deep

There are a couple of constraints worth knowing before you set this up:

• Customer managed keys must be created in the same AWS account and region as your MLflow App
• Only symmetric AWS KMS keys are supported

This feature is generally available (GA) in all AWS Regions where MLflow App is available. You can find setup details on the SageMaker MLflow detail page.

Wrap-up

• SageMaker MLflow now supports encryption with customer managed keys (CMK) via AWS KMS
• You can encrypt your data with your own keys while auditing access through CloudTrail
• Keys must be symmetric AWS KMS keys in the same account and region as your MLflow App
• Available in every region where MLflow App is offered
• A welcome update for organizations with strict security and compliance requirements