Deepgram enhances Amazon SageMaker AI support with AWS IAM Temporary Delegation

Deepgram has integrated with AWS IAM Temporary Delegation to streamline support for enterprises running self-hosted speech AI models on Amazon SageMaker AI. This new capability allows Deepgram engineers to obtain scoped, time-limited, customer-approved access to specific SageMaker AI endpoints without provisioning long-lived cross-account IAM roles or sharing secrets.

Background

Enterprises choose to self-host Deepgram speech models on SageMaker AI for data residency, network isolation, and regulatory compliance. However, production deployments require support when models return unexpected results or endpoints misbehave. Traditionally, diagnosing issues required scheduling screen-shares or provisioning long-lived cross-account roles, which are operationally expensive and difficult to audit.

IAM Temporary Delegation

IAM Temporary Delegation is a new AWS IAM capability that enables partners to submit delegation requests against pre-registered permission templates. Customers review and approve requests in their own IAM console, and AWS issues short-lived STS credentials scoped to the template. No IAM roles, long-lived keys, or cross-account trust are needed.

How the Integration Works

The integration is built into Deepgram's support ticketing system. The end-to-end flow is as follows:

1. Engineer runs the /delegate_access command in the support ticket.
2. Customer provides the SageMaker AI endpoint ARN.
3. System calls iam:CreateDelegationRequest with the pre-registered DeepgramSageMakerReadOnlyTroubleshooting permission template.
4. Customer opens a deep link to their IAM console, reviews the fully resolved permissions, and approves the request.
5. System exchanges the token for STS credentials, which expire automatically after 12 hours.
6. Engineer verifies endpoint and log access using the issued credentials.
7. Customer can revoke access at any time and verify delegated activity in AWS CloudTrail.

What the Customer Sees

Customers see an approval screen in their IAM console showing who is requesting access, for how long, why, and a plain-language summary of permissions. They can view the exact policy in JSON format, with every action and resource ARN spelled out. Reviewers with iam:AcceptDelegationRequest permission can approve directly; others can forward the request to an administrator.

Benefits

The integration reduces time-to-first-look on support tickets from days to minutes. It replaces recurring IAM role provisioning with a no-standing-access posture that is strictly stronger. Every API call made using delegated credentials is recorded in the customer's AWS CloudTrail, tagged with Deepgram's partner account ID.

Prerequisites and Cleanup

To use the integration, customers need an active Deepgram model deployment on SageMaker AI, IAM permissions to review and approve delegation requests, an AWS CloudTrail trail enabled, and an active Deepgram support contract. Cleanup involves revoking delegation requests, deleting the SageMaker AI endpoint, endpoint configuration, model, and associated CloudWatch log group.

Conclusion

Self-hosted speech AI on SageMaker AI supports enterprise data residency and compliance needs. IAM Temporary Delegation closes the day-two support gap, enabling Deepgram engineers to diagnose customer endpoints in minutes with scoped, time-bounded access that customers approve and audit end-to-end.

Images