Check provider logo

Amazon SageMaker Model Registry should have at least one approved model package

sagemaker_models_registry_in_use

Severitylow
Servicesagemaker
by Prowler
gen-aisoftware-supply-chain

SageMaker Model Registry is evaluated to verify that at least one Model Package Group exists and contains at least one model package with ModelApprovalStatus = Approved. This confirms that the ML governance workflow (register → review → approve → deploy) is actively in use.

Risk

An empty Model Registry, or one with no approved packages, indicates that models are being deployed outside any review process. This breaks provenance and accountability for production ML workloads, making it impossible to enforce governance controls such as auditing, versioning, and approval workflows.

Run this check with Prowler CLI

prowler aws --checks sagemaker_models_registry_in_use

Run in Prowler Cloud

Recommendation

Register all production models in the SageMaker Model Registry and enforce an approval workflow before deployment. Ensure at least one model package per group reaches Approved status. Use IAM policies to restrict who can approve model packages and integrate with CI/CD pipelines to automate registration.

Remediation

CLI

aws sagemaker list-model-package-groups aws sagemaker list-model-packages --model-package-group-name <group-name> aws sagemaker update-model-package --model-package-arn <arn> --model-approval-status Approved

Other
  1. In the AWS console, navigate to SageMaker > Models > Model Registry.
  2. Create a Model Package Group if none exists.
  3. Register a model version in the group.
  4. Review and approve at least one model package by setting its approval status to Approved.

Source Code

Resource Type

Other

References