-
Notifications
You must be signed in to change notification settings - Fork 0
/
Copy pathtemplate.yaml
351 lines (321 loc) · 12.4 KB
/
template.yaml
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
AWSTemplateFormatVersion: '2010-09-09'
Parameters:
###########################
### Editable parameters ###
###########################
DefaultVpcId:
Type: AWS::EC2::VPC::Id
Description: Select the default VPC. The database will be created in it. Used to define DB security group.
DefaultRouteTableId:
Type: String
Description: Select the default route table.
SubnetId1:
Type: AWS::EC2::Subnet::Id
Description: Subnet id where the Cloud9 instance will be deployed
SubnetId2:
Type: AWS::EC2::Subnet::Id
Description: Subnet id where the Cloud9 instance will be deployed
DBUsername:
Type: String
Description: Name of the master user
########################
### Fixed parameters ###
########################
ModelName:
Type: String
Default: churn-prediction-model
Description: The SageMaker model name
EndpointConfigName:
Type: String
Default: churn-prediction-endpoint-config
Description: The SageMaker model endpoint config name
EndpointName:
Type: String
Default: churn-prediction-endpoint
Description: The SageMaker model endpoint name used
Resources:
#######################
### Cloud9 Instance ###
#######################
Cloud9Instance:
Type: AWS::Cloud9::EnvironmentEC2
Properties:
Name: aurora-ml
Description: Cloud9 IDE Instance used to interact with the RDS Aurora Cluster
InstanceType: t2.large
ImageId: ubuntu-18.04-x86_64
AutomaticStopTimeMinutes: 30
ConnectionType: CONNECT_SSH
SubnetId: !Ref SubnetId1
#######################
### Secrets Manager ###
#######################
MasterSecretsKMSKey:
Type: AWS::KMS::Key
Properties:
Description: Key used to encrypt database secrets in AWS SecretsManager
KeyPolicy:
Version: 2012-10-17
Id: key-default-1
Statement:
- Sid: Enable IAM User Permissions
Effect: Allow
Principal: '*'
Action: 'kms:*'
Resource: '*'
MasterPassword:
Type: AWS::SecretsManager::Secret
Properties:
Name: '/rds/database-aurora-ml-master-password'
Description: Aurora database master password
GenerateSecretString:
PasswordLength: 16
ExcludePunctuation: true
KmsKeyId: !Ref MasterSecretsKMSKey
MasterUsername:
Type: AWS::SecretsManager::Secret
Properties:
Name: '/rds/database-aurora-ml-master-username'
Description: Aurora database master user
SecretString: !Ref DBUsername
KmsKeyId: !Ref MasterSecretsKMSKey
#######################
### Aurora ###
#######################
AuroraDbIamRole:
Type: AWS::IAM::Role
Properties:
AssumeRolePolicyDocument:
Version: 2012-10-17
Statement:
- Effect: Allow
Principal:
Service:
- rds.amazonaws.com
Action:
- sts:AssumeRole
Path: /
Policies:
- PolicyName: aurora-ml-sagemaker-endpoint-access
PolicyDocument:
Version: 2012-10-17
Statement:
- Sid: AllowAuroraToInvokeSagemakerEndpoint
Effect: Allow
Action:
- sagemaker:InvokeEndpoint
Resource: !Ref SageMakerEndpoint
AuroraDBParameterGroup:
Type: AWS::RDS::DBClusterParameterGroup
Properties:
DBClusterParameterGroupName : aurora-ml-db-cluster-parameter-group
Description: Aurora ML cluster parameter group
Family: aurora-mysql8.0
Parameters:
aws_default_sagemaker_role: !GetAtt AuroraDbIamRole.Arn
AuroraDBSubnetGroup:
Type: AWS::RDS::DBSubnetGroup
Properties:
DBSubnetGroupName: aurora-ml-subnet-group
DBSubnetGroupDescription: aurora-ml-subnet-group
SubnetIds:
- !Ref SubnetId1
- !Ref SubnetId2
AuroraDBCluster:
Type: AWS::RDS::DBCluster
Properties:
DBClusterIdentifier: database-aurora-ml
Engine: aurora-mysql
EngineMode: provisioned
EngineVersion: 8.0.mysql_aurora.3.03.1
DBSubnetGroupName: !Ref AuroraDBSubnetGroup
DBClusterParameterGroupName: !Ref AuroraDBParameterGroup
AssociatedRoles:
- RoleArn: !GetAtt AuroraDbIamRole.Arn
VpcSecurityGroupIds:
- !Ref StackSecurityGroup
MasterUsername: !Join ['', ['{{resolve:secretsmanager:', !Ref MasterUsername, '}}' ]]
MasterUserPassword: !Join ['', ['{{resolve:secretsmanager:', !Ref MasterPassword, '}}' ]]
StorageEncrypted: false
AuroraDBInstance:
Type: AWS::RDS::DBInstance
DependsOn: AuroraDBCluster
Properties:
Engine: aurora-mysql
DBClusterIdentifier: database-aurora-ml
DBInstanceIdentifier: database-aurora-ml-instance-1
DBInstanceClass: db.t3.large
AllowMajorVersionUpgrade: false
AutoMinorVersionUpgrade: true
PubliclyAccessible: false
#######################
### SageMaker ###
#######################
SageMakerIamRole:
Type: AWS::IAM::Role
Properties:
AssumeRolePolicyDocument:
Version: 2012-10-17
Statement:
- Effect: Allow
Principal:
Service:
- sagemaker.amazonaws.com
Action:
- sts:AssumeRole
Path: /
Policies:
- PolicyName: sagemaker-aurora-access
PolicyDocument:
Version: 2012-10-17
Statement:
-
# As per recommendation here: https://docs.aws.amazon.com/sagemaker/latest/dg/host-vpc.html#:~:text=amazonaws.com/*%22%20%0A%20%20%20%20%20%20%20%20%20%20%20%20%20%20%5D%20%0A%20%20%20%20%20%20%20%20%20%7D%20%0A%20%20%20%20%5D%20%0A%7D-,Add%20Permissions%20for%20Endpoint%20Access%20for%20Containers%20Running%20in%20a%20VPC%20to%20Custom%20IAM%20Policies,-The%20SageMakerFullAccess%20managed
Effect: Allow
Action:
- ec2:DescribeVpcEndpoints
- ec2:DescribeDhcpOptions
- ec2:DescribeVpcs
- ec2:DescribeSubnets
- ec2:DescribeSecurityGroups
- ec2:DescribeNetworkInterfaces
- ec2:DeleteNetworkInterfacePermission
- ec2:DeleteNetworkInterface
- ec2:CreateNetworkInterfacePermission
- ec2:CreateNetworkInterface
Resource: '*'
-
Effect: Allow
Action: kms:Decrypt
Resource: '*'
-
Effect: Allow
Action: logs:CreateLogStream
Resource: '*'
-
Effect: Allow
Action: s3:GetObject
Resource:
- 'arn:aws:s3:::aws-blog-real-time-ml-predictions-in-amazon-aurora-db-part-2/automl-churn-22-07-58-14/data-processor-models/automl-churn-22-07-58-14-dpp4-1-fd558818369c4e17b96a1d3ab7df5e0/output/model.tar.gz'
- 'arn:aws:s3:::aws-blog-real-time-ml-predictions-in-amazon-aurora-db-part-2/automl-churn-22-07-58-14/tuning/automl-chu-dpp4-xgb/automl-churn-22-07-58-141qfYgxKy-019-576d554c/output/model.tar.gz'
-
Effect: Allow
Action: s3:ListBucket
Resource: '*'
SageMakerModel:
Type: AWS::SageMaker::Model
Properties:
ModelName: !Ref ModelName
ExecutionRoleArn: !GetAtt SageMakerIamRole.Arn
EnableNetworkIsolation: false
Containers:
-
Image: '683313688378.dkr.ecr.us-east-1.amazonaws.com/sagemaker-sklearn-automl:2.5-1-cpu-py3'
ModelDataUrl: 's3://aws-blog-real-time-ml-predictions-in-amazon-aurora-db-part-2/automl-churn-22-07-58-14/data-processor-models/automl-churn-22-07-58-14-dpp4-1-fd558818369c4e17b96a1d3ab7df5e0/output/model.tar.gz'
Environment:
AUTOML_SPARSE_ENCODE_RECORDIO_PROTOBUF: '1'
AUTOML_TRANSFORM_MODE: feature-transform
SAGEMAKER_DEFAULT_INVOCATIONS_ACCEPT: application/x-recordio-protobuf
SAGEMAKER_PROGRAM: sagemaker_serve
SAGEMAKER_SUBMIT_DIRECTORY: /opt/ml/model/code
-
Image: '683313688378.dkr.ecr.us-east-1.amazonaws.com/sagemaker-xgboost:1.3-1-cpu-py3'
ModelDataUrl: 's3://aws-blog-real-time-ml-predictions-in-amazon-aurora-db-part-2/automl-churn-22-07-58-14/tuning/automl-chu-dpp4-xgb/automl-churn-22-07-58-141qfYgxKy-019-576d554c/output/model.tar.gz'
Environment:
MAX_CONTENT_LENGTH: '20971520'
SAGEMAKER_DEFAULT_INVOCATIONS_ACCEPT: text/csv
SAGEMAKER_INFERENCE_OUTPUT: predicted_label
SAGEMAKER_INFERENCE_SUPPORTED: 'predicted_label,probability,probabilities'
-
Image: '683313688378.dkr.ecr.us-east-1.amazonaws.com/sagemaker-sklearn-automl:2.5-1-cpu-py3'
ModelDataUrl: 's3://aws-blog-real-time-ml-predictions-in-amazon-aurora-db-part-2/automl-churn-22-07-58-14/data-processor-models/automl-churn-22-07-58-14-dpp4-1-fd558818369c4e17b96a1d3ab7df5e0/output/model.tar.gz'
Environment:
AUTOML_TRANSFORM_MODE: inverse-label-transform
SAGEMAKER_DEFAULT_INVOCATIONS_ACCEPT: text/csv
SAGEMAKER_INFERENCE_INPUT: predicted_label
SAGEMAKER_INFERENCE_OUTPUT: predicted_label
SAGEMAKER_INFERENCE_SUPPORTED: 'predicted_label,probability,labels,probabilities'
SAGEMAKER_PROGRAM: sagemaker_serve
SAGEMAKER_SUBMIT_DIRECTORY: /opt/ml/model/code
# As per recommendation here: https://docs.aws.amazon.com/sagemaker/latest/dg/host-vpc.html
VpcConfig:
SecurityGroupIds:
- !Ref StackSecurityGroup
Subnets:
- !Ref SubnetId1
- !Ref SubnetId2
SageMakerEndpointConfig:
Type: AWS::SageMaker::EndpointConfig
DependsOn: SageMakerModel
Properties:
EndpointConfigName: churn-prediction-endpoint-config
ProductionVariants:
-
ModelName: !Ref ModelName
VariantName: main
InitialInstanceCount: 1
InstanceType: ml.m5.large
InitialVariantWeight: 1.0
SageMakerEndpoint:
Type: AWS::SageMaker::Endpoint
DependsOn:
- SageMakerEndpointConfig
- VpcS3Endpoint
Properties:
EndpointName: !Ref EndpointName
EndpointConfigName: !Ref EndpointConfigName
RetainAllVariantProperties: true
###################################
### Networking Configuration ###
###################################
StackSecurityGroup:
Type: AWS::EC2::SecurityGroup
Properties:
GroupDescription: Aurora instance and SageMaker endpoint security group
VpcId: !Ref DefaultVpcId
StackSecurityGroupIngress:
Type: AWS::EC2::SecurityGroupIngress
Properties:
Description: Define egress rules between the Aurora instance and Sagemaker endpoint
GroupId: !Ref StackSecurityGroup
IpProtocol: tcp
FromPort: 0
ToPort: 65535
SourceSecurityGroupId: !Ref StackSecurityGroup
StackSecurityGroupEgress:
Type: AWS::EC2::SecurityGroupEgress
Properties:
Description: Define egress rules between the Aurora instance and Sagemaker endpoint
GroupId: !Ref StackSecurityGroup
IpProtocol: tcp
FromPort: 0
ToPort: 65535
DestinationSecurityGroupId: !Ref StackSecurityGroup
# CidrIp: 0.0.0.0/0
VpcS3Endpoint:
Type: AWS::EC2::VPCEndpoint
Properties:
VpcEndpointType: 'Gateway'
VpcId: !Ref DefaultVpcId
ServiceName: !Sub 'com.amazonaws.${AWS::Region}.s3'
RouteTableIds:
- !Ref DefaultRouteTableId
VpcSageMakerEndpoint:
Type: AWS::EC2::VPCEndpoint
Properties:
VpcEndpointType: 'Interface'
VpcId: !Ref DefaultVpcId
ServiceName: !Sub 'com.amazonaws.${AWS::Region}.sagemaker.runtime'
PrivateDnsEnabled: true
SubnetIds:
- !Ref SubnetId1
- !Ref SubnetId2
SecurityGroupIds:
- !Ref StackSecurityGroup
Outputs:
Cloud9InstanceURL:
Description: Cloud9 IDE URL
Value: !Sub "https://console.aws.amazon.com/cloud9/ide/${Cloud9Instance}"
ModelEndpointName:
Description: Name of the SageMaker endpoint to be used in the SQL `predict_churn` function
Value: !Ref EndpointName