You’ve wired up Looker. You’ve spun up Amazon SageMaker. Then you realize half the time you’re waiting for credentials, and the other half you’re wondering which dataset is drifting under the radar. Integration pain like that feels old-school, the sort of thing automation should have solved years ago.
Looker handles insights, dashboards, and data modeling. SageMaker trains and deploys machine learning models at scale. When paired, they turn raw data into predictions you can visualize instantly. But connecting them securely and reliably is trickier than marketing slides admit. Each lives in a separate trust domain: Looker pulls from governed SQL sources, SageMaker lives on AWS with IAM policies that evolve faster than your caffeine intake.
The goal is simple. You want Looker querying SageMaker endpoints as if they were ordinary data sources, without bursting open the perimeter. That means mapping identity between systems, managing ephemeral credentials, and routing requests through a verified proxy. You don’t have to reinvent authentication to do it.
Integration workflow
Start with your identity provider. Okta or any OIDC-compatible source works. Issue short-lived tokens scoped only for prediction requests. In AWS, create an IAM role with limited SageMaker runtime permissions. Use federation rules to tie that role to Looker’s service identity. When Looker kicks off a query to SageMaker, requests pass through your identity-aware gateway, get signed, hit the model endpoint, and flow back cleanly. The design keeps credentials off dashboards and satisfies SOC 2 audit trails automatically.
If something fails, 90% of the time it’s token lifetime mismatch or stale caching. Rotate secrets frequently. Keep TTLs under ten minutes for production. Logging every request with session metadata helps isolate intermittent role assumption issues before they turn into outages.