AWS SageMaker: Embedding the MLflow UI in a Custom Portal with React

AWS has published a detailed guide to embedding the SageMaker MLflow Apps UI directly in a custom web application. The documentation describes the full architecture (React + Flask + AWS CDK), the deployment process and the key security considerations for enterprise scenarios.

Why embed MLflow in your own portal

MLflow is a popular tool for tracking ML experiments, versioning models and managing artifacts. Data scientists and engineers use it constantly. The problem: when a company runs many systems, employees lose time switching between interfaces.

SageMaker MLflow Apps lets you run MLflow in the AWS cloud. Embedding this service in a corporate portal used to be difficult: it required correct handling of AWS authentication, request proxying and access management. AWS has now published a ready-made solution that you can copy and adapt to your own needs.

Architecture: React, Flask and SigV4

The solution has three layers. The React frontend renders the MLflow interface, manages the user session and sends requests to the backend. The Flask reverse proxy intercepts requests from the browser, adds an AWS Signature Version 4 (SigV4) signature to each one, forwards it to SageMaker MLflow and returns the response to the client.

• The React app handles the UI and user authorization
• The Flask handler adds SigV4 signatures to requests
• AWS SageMaker MLflow processes model and experiment data
• AWS CDK automatically creates all the infrastructure
• CloudTrail logs all operations for auditing

The whole stack is deployed through AWS CDK (Cloud Development Kit), an Infrastructure as Code tool that automatically creates all the required AWS resources from Python or TypeScript code.

How security works

SigV4 is a digital signature mechanism for AWS API requests. The Flask server holds IAM credentials and signs every request before sending it to SageMaker. The browser itself never sees the AWS keys, which are stored only on the Flask server.

"A reverse proxy architecture lets you centralize authentication and

retain full control over access," is how the AWS documentation describes the approach.

This keeps credentials hidden from the client, allows access control through IAM policies, logs all requests in CloudTrail and lets you separate permissions by user. Even if a user opens the browser's DevTools, they will not find any secret AWS keys.

What this means

AWS has made migrating MLflow into the enterprise easier. Large companies can now integrate SageMaker MLflow into their corporate portal, a single application through which employees reach all their tools.

The guide includes the full source code, step-by-step deployment instructions and a checklist for verifying the deployment.