# Managing MLflow models across multiple AWS accounts is the only > Source: > Published: 2026-09-08 18:01:00+00:00 # Managing MLflow models across multiple AWS accounts is the only ## Handling the Cross-Account Topology The biggest headache in an AI workflow is usually the "governance gap"—the space between a data scientist hitting `mlflow.log_model()` and a DevOps engineer actually deploying that artifact. To solve this, there are two main ways to structure your accounts: 1. **Hub-and-Spoke:** You share a single MLflow app across multiple development accounts using AWS Resource Access Manager (AWS RAM). This centralizes the registry but allows devs to log from their own spokes. 2. **Hybrid Isolation:** This is for highly regulated environments. Development accounts stay fully isolated, and models are approved locally by a "model owner" before being promoted to the central governance hub. The setup isn't just a click of a button; you need a specific IAM configuration. Specifically, you have to deal with destination groups and bucket policies to ensure the S3 artifacts actually migrate between accounts without throwing a 403 Forbidden error. ## Deployment Workflow and Requirements To get this working, you can't just wing it with the console. You need a structured deployment. If you're trying to replicate this, you'll need at least two distinct AWS accounts (which I've labeled `mlops-spoke` and `mlops-hub` in my CLI profiles) to test the hand-off. For those wanting a hands-on guide to the infrastructure, you'll need to deploy a CloudFormation stack in both accounts. The specific template to look for is `cfn/sagemaker-studio-mlflow.yaml`. The critical setting here is `AutoModelRegistrationEnabled`—if this isn't set to true in your MLflow app configuration, the sync to the SageMaker Model Registry won't trigger, and your governance officer will see an empty registry. ## Practical Tutorial for the Setup If you're building this from scratch, follow these steps to handle the cross-account synchronization: 1. **Infrastructure Provisioning:** Deploy the CloudFormation stack in both the hub and spoke accounts. Ensure the execution roles have the necessary permissions to interact with the SageMaker Studio domain. 2. **Resource Sharing:** Use AWS RAM in the hub account to share the MLflow instance with the spoke account IDs. 3. **Identity Mapping:** Configure your AWS CLI profiles. I recommend using named profiles to avoid session confusion: ``` aws configure --profile mlops-spoke aws configure --profile mlops-hub ``` 4. **Model Promotion:** The data scientist logs the model in the spoke account. The governance officer then uses the SageMaker Studio Models UI in the hub account to review the version and update the lifecycle stage (e.g., from "Staging" to "Production"). The real power here is integrating this into a CI/CD pipeline. Once a model is marked as "Approved" in the registry, it can trigger a pipeline that deploys the artifact to a SageMaker endpoint. This removes the manual "export-import" dance that usually plagues ML deployments. By separating the personas—the data scientist who only sees MLflow and the governance officer who manages the registry—you create a hard gate that prevents untested models from hitting production. It's a much cleaner way to handle LLM agent deployment or traditional ML models at scale. [Next Local AI is moving from "toy" status to actually handling heavy →](/en/threads/8994/)