Deepgram enhances Amazon SageMaker AI support with AWS IAM Temporary Delegation Deepgram has integrated with AWS IAM Temporary Delegation to grant partners scoped, time-limited, customer-approved access to specific resources, reducing the time for initial investigation on a SageMaker AI support ticket from days to minutes. The integration eliminates long-lived credentials and cross-account roles, enabling fast, auditable support for enterprises running self-hosted Deepgram speech AI models on Amazon SageMaker AI. Deepgram offers AWS Marketplace listings for Nova, Flux, and Aura-2 models, along with validated reference architectures and Terraform modules. Artificial Intelligence https://aws.amazon.com/blogs/machine-learning/ Deepgram enhances Amazon SageMaker AI support with AWS IAM Temporary Delegation Enterprises running self-hosted speech AI need fast, auditable support without giving partners long-lived access to their accounts. When a model returns unexpected results or an endpoint misbehaves, the engineer best positioned to diagnose it is often on the partner side. But provisioning cross-account AWS Identity and Access Management IAM roles for every support engagement is operationally expensive and a recurring audit conversation. Amazon SageMaker AI delivers a managed deployment option for self-hosted Deepgram speech AI models. It provides AWS Marketplace listings for Nova, Flux, and Aura-2, along with validated reference architectures and Terraform modules that layer onto existing AWS infrastructure. To bring the same operational maturity to day-two support, Deepgram has integrated with IAM temporary delegation https://docs.aws.amazon.com/IAM/latest/UserGuide/access policies-temporary-delegation.html , a new IAM capability that grants partners scoped, time-limited, customer-approved access to specific resources, with no long-lived credentials, no cross-account roles to provision, and no shared secrets. In this post, we cover why Deepgram built on IAM temporary delegation, how the integration works end-to-end, and what it unlocks for customers running Deepgram speech models on SageMaker AI. With this integration, Deepgram has reduced the time for initial investigation on a SageMaker AI support ticket from days to minutes. Previously, initial investigation required scheduling a screen-share across customer and partner calendars. Now a customer approves a request in their own IAM console, which also reduces long-standing cross-account access. Amazon SageMaker AI delivers a managed control plane for self-hosted Deepgram Enterprise customers choose to self-host Deepgram for the usual reasons: data residency, network isolation, and regulatory compliance. But they don’t want to trade away the operational posture of a managed cloud service to get there. SageMaker AI is how we close that gap: a single AWS native control plane for deploying, scaling, and observing Deepgram speech models inside the customer’s own account. Deepgram has invested in SageMaker AI as a first-class deployment target across the axes that matter most to enterprise platform teams: - AWS Marketplace listings for Deepgram’s Nova, Flux, and Aura spanning speech-to-text STT and text-to-speech TTS speech models, with one-click subscription and consolidated AWS billing. - Validated reference architectures covering Amazon Virtual Private Cloud Amazon VPC isolation, AWS PrivateLink, auto scaling, and observability. - Terraform modules that platform teams can layer onto their existing AWS infrastructure instead of building the deployment from scratch. The result is a self-hosted experience that no longer means “you’re on your own.” The support access problem Production deployments eventually need support. A model is returning unexpected results, an endpoint is autoscaling slower than expected, graphics processing unit GPU utilization looks off. The engineer best positioned to diagnose it is on the Deepgram team. The challenge they face is how to investigate a workload running inside a customer Amazon VPC they don’t have access to. The traditional options all have drawbacks. Long-lived cross-account IAM roles work, but customers don’t want to provision, audit, and remember to revoke them, and platform teams don’t want to be the ones answering for them at the next audit. Shared screens and copy-pasted logs are slow, error-prone, and a poor fit for regulated environments where every command needs to be attributable. Asking the customer to run commands on Deepgram’s behalf works for trivial issues, but doesn’t scale for issues that require iteration. We needed a way to give a Deepgram engineer scoped, auditable access to exactly one SageMaker AI endpoint, for a bounded window, with the customer in control of the approval and no standing trust between accounts. Prerequisites To use the integration described in this post, you need the following: - An active Deepgram model deployment on Amazon SageMaker AI in your AWS account. - IAM permissions in your AWS account to review and approve delegation requests, including iam:GetDelegationRequest and iam:AcceptDelegationRequest . - An AWS CloudTrail trail enabled in the AWS Region where the SageMaker AI endpoint runs, so delegated API calls are captured for audit. - An active Deepgram support contract or account that includes access to the Deepgram support ticketing system. - Awareness that running this integration incurs AWS charges for SageMaker AI endpoint hosting including GPU instances , Amazon CloudWatch logs, AWS CloudTrail, and associated networking resources. Deepgram offers a 14-day trial at no additional cost for its models, but AWS infrastructure costs apply from the start of deployment. IAM temporary delegation IAM temporary delegation https://docs.aws.amazon.com/IAM/latest/UserGuide/access policies-temporary-delegation.html is a new IAM capability built for exactly this shape of problem. The partner submits a delegation request against a pre-registered, parameterized permission template. The customer reviews it in their own IAM console and sees the fully resolved permissions, with every resource Amazon Resource Name ARN spelled out and no wildcards. The customer then approves the request. AWS then issues short-lived AWS Security Token Service AWS STS credentials to the partner, scoped to the template, bounded by SessionDuration , and tagged in the customer’s AWS CloudTrail with the partner’s account ID for end-to-end auditability. No IAM roles to create. No long-lived keys to rotate. No cross-account trust to maintain. Approval lives where security teams already expect it: in the customer’s own IAM console. How Deepgram’s integration works Deepgram engineers keep working in the support ticketing system throughout the workflow. The integration is built directly into Deepgram’s support ticketing system, wired to AWS over a single Amazon Simple Notification Service Amazon SNS topic. End-to-end flow each step is labeled with the actor who performs it, whether Engineer, Customer, or System : - Engineer In the customer support ticket, run the /delegate access command. - Customer When the integration prompts you in the ticket, reply with the SageMaker AI endpoint ARN, the single piece of information that scopes the entire request. To find the ARN, run aws sagemaker describe-endpoint --endpoint-name