ML Provisioner Enterprise by Axon Tech Labs automates AWS MLOps pipeline infrastructure provisioning via CloudFormation - scaffolding SageMaker Model Registry, CodePipeline, CodeBuild, S3, EventBridge, KMS encryption, VPC endpoints, compliance monitoring, and IAM permission boundaries from a single YAML configuration file. Build compliant, VPC-integrated ML environments in minutes rather than weeks.
The Enterprise tier is designed for organizations with strict security, compliance, and network isolation requirements. It includes KMS Customer Managed Keys, four private VPC endpoints (SageMaker API, SageMaker Runtime, S3 Gateway, STS), a dedicated endpoint Security Group, CloudWatch compliance log group with metric filters and alarms, SNS security alerting, and IAM permission boundaries - all as a single CloudFormation stack.
Note: Enterprise tier requires a VPC before provisioning. VPC ID and subnet IDs can be supplied directly or resolved from AWS Systems Manager Parameter Store (recommended when using the Axon Tech Labs VPC Provisioner).
Key Capabilities
Enterprise-Grade Security and Compliance: KMS Customer Managed Keys, private VPC endpoints, CloudWatch compliance log group with metric filters, unauthorized API call and root account usage alarms, SNS security alerting, and IAM permission boundaries. No manual resource configuration required.
Continuous Compliance and Auditability: Built-in drift detection identifies unauthorized manual changes. Compliance logs and security alarms provide continuous monitoring. Every provisioner action generates an auditable log file.
Event-Driven Model Deployment: Automatically trigger the deploy pipeline when a model is approved in SageMaker Model Registry via EventBridge - no manual execution required.
Safe Deployment Pipeline: Multi-stage validation with YAML schema checks, CloudFormation structural validation, and isolated test-deploy namespaces with random suffixes.
Pre-Deployment Visibility: Generate CloudFormation Change Sets and HTML review reports for team sign-off before any changes touch live environments.
12 Actions
validate-config - Validate YAML config against tier schema
list-products - List available tier templates
show-product - Display resources and SSM outputs for active tier
create-policy - Generate least-privilege IAM deployer policy
validate-prov-template - Validate template structure and references
create-review-report - Generate pre-deployment HTML review report
show-changes - Preview infrastructure changes via CloudFormation ChangeSet
check-drift - Detect drift on deployed stack resources
test-deploy - Deploy to isolated namespace with random suffix
deploy-product - Provision ML pipeline infrastructure stack
delete-product - Tear down stack and all associated resources
How It Works
Configure: Define your infrastructure in a YAML file - tier, source control, VPC integration mode, and alerts email
Execute: Run the Docker container with your config and credentials mounted
Review: Generate templates, IAM policies, and review reports before deploying
Deploy: Provision to AWS via CloudFormation
Highlights
Enterprise ML Infrastructure - SageMaker Model Registry, CodePipeline, CodeBuild, S3 artifacts bucket, EventBridge automation, KMS Customer Managed Key encryption, four private VPC endpoints (SageMaker API, SageMaker Runtime, S3 Gateway, STS), CloudWatch compliance log group with alarms, SNS security alerting, and IAM permission boundaries. 12 actions cover the full lifecycle from policy generation to stack teardown.
Compliance and Auditability - Built-in drift detection identifies unauthorized manual changes to your deployed infrastructure. Compliance logs, metric filters, and CloudWatch alarms provide continuous security monitoring. Every provisioner action generates an auditable log file for team visibility.
VPC-Isolated ML Pipelines - All ML traffic routed through private VPC endpoints - SageMaker, S3, and STS never traverse the public inter
AWS Marketplace now accepts line of credit payments through the PNC Vendor Finance program. This program is available to select AWS customers in the US, excluding NV, NC, ND, TN, & VT.
Pricing is based on the duration and terms of your contract with the vendor. This entitles you to a specified quantity of use for the contract duration. If you choose not to renew or replace your contract before it ends, access to these entitlements will expire.
Additional AWS infrastructure costs may apply. Use the AWS Pricing Calculator to estimate your infrastructure costs.
This listing offers one pricing dimension: the ML Provisioner Enterprise License, billed per unit under a contract. You buy licenses in the quantity you need, so cost scales with the number of units. This Enterprise-grade license provisions MLOps pipeline infrastructure through CloudFormation, delivered as a Docker-based tool. It includes VPC integration, KMS encryption, compliance monitoring, and permission boundaries. There are no separate usage-based charges or add-on dimensions here. Your total cost depends only on how many license units you commit to for the contract term.
Top-of-mind questions for buyers
What counts as one license unit for billing?
A license unit authorizes deployment of the ML Provisioner in one AWS account. The tool grants a license per AWS account with no template sharing between accounts. To provision the infrastructure in more than one account, you commit to more license units accordingly.
What AWS resources does this Enterprise license provision when I deploy?
It deploys a SageMaker Model Registry, source control repositories, CodeBuild, and CodePipeline CI/CD pipelines as one CloudFormation stack. The Enterprise setup adds KMS encryption, compliance log groups, CloudWatch alarms, SNS alerting, VPC endpoints, and permission boundaries. Automated IAM and SSM Parameter Store outputs are included.
Does adding more ML deployments in the same account increase my cost?
No. Cost scales with license units, and each unit covers one AWS account. Within a licensed account you can provision multiple ML products and use cases without buying more units. You add units only when you deploy in additional AWS accounts.
docs.axontechlabs.com
Helpful?
Vendor refund policy
30-day money-back guarantee for monthly subscriptions. Pro-rated refunds for annual subscriptions cancelled within the first 30 days.
How can we make this page better?
Tell us how we can improve this page, or report an issue with this product.
Give us feedbackReport a problem with this product or seller
Legal
Vendor terms and conditions
Upon subscribing to this product, you must acknowledge and agree to the terms and conditions outlined in the vendor's End User License Agreement (EULA).
Content disclaimer
Vendors are responsible for their product descriptions and other product content. AWS does not warrant that vendors' product descriptions or other product content are accurate, complete, reliable, current, or error-free.
Containers are lightweight, portable execution environments that wrap server application software in a filesystem that includes everything it needs to run. Container applications run on supported container runtimes and orchestration services, such as Amazon Elastic Container Service (Amazon ECS) or Amazon Elastic Kubernetes Service (Amazon EKS). Both eliminate the need for you to install and operate your own container orchestration software by managing and scheduling containers on a scalable cluster of virtual machines.
Version release notes
Bug fix: resolved AttributeError when deploying with source_control: s3 configuration (s3_prefix attribute was missing from ALLOWED_ML_KEYS in config loader).
Additional details
Usage instructions
Run the container to see all available actions and options:
docker run --rm
-v ~/.aws:/home/mluser/.aws:ro
709825985650.dkr.ecr.us-east-1.amazonaws.com/axon-tech-labs/enterprise-ml-provisioner:1.0.0 --help
Axon Tech Labs provides comprehensive support for ML Provisioner customers through email and documentation.
Email Support
Address:
Response Time: Within 24 hours (business days)
Hours: Monday-Friday, 9 AM - 5 PM Pacific Time
AWS infrastructure support
AWS Support is a one-on-one, fast-response support channel that is staffed 24x7x365 with experienced and technical support engineers. The service helps customers of all sizes and technical abilities to successfully utilize the products and features provided by Amazon Web Services.
Automate S3, VPC, and IAM infrastructure at enterprise scale. 40 actions with full IAM automation, cross-account roles, and 31 policy templates across 9 AWS services. 15% bundle savings.
Automated AWS IAM security provisioning via CloudFormation. 10 IAM groups, expanded service roles, assumable roles, policy coverage across S3, ECR, SageMaker, Lambda, and Bedrock. Docker-based.
Be the first to review this product. We've partnered with PeerSpot to gather customer feedback. You can share your experience by writing or recording a review, or scheduling a call with a PeerSpot analyst.