This architecture creates an environment where a buyer can consume a seller’s application into their own virtual private cloud (VPC), protecting the buyer’s data privacy while also protecting the seller’s application intellectual property through isolated network access controls and subscription authorization.
Seller writes and packages their model code as a docker image and pushes the image into Amazon Elastic Container Registry (Amazon ECR).
Seller packages and pushes the image as machine learning (ML) model for listing on AWS Marketplace.
Buyer subscribes to the listing on AWS Marketplace using AWS Management Console.
Upon subscription, an Amazon SageMaker instance is provisioned in the buyer VPC in network isolation mode along with the model container image and the invocation endpoint.
Buyer runs the CFN template that deploys the AWS Lambda functions from the zip file located in the Amazon Simple Storage Service (Amazon S3) repository.
Buyer application invokes a Lambda initialization endpoint to validate their subscription from the seller.
Lambda authorizer invokes the Lambda function running in the seller’s VPC to return authorization token valid for a certain duration.
Buyer application invokes a Lambda /request endpoint along with an authorization token and the data to be processed.
Lambda authorizer validates the authorization token and forwards the call to the Lambda proxy.
Lambda proxy calls the SageMaker endpoint running in network isolation mode along with the data to be processed.
SageMaker endpoint returns the response back to the Lambda function along with the processed data.
Lambda stores the response in the Amazon S3 bucket for the buyer application to use.
