Skip to content

Commit f1af7fc

Browse files
badmintoncryerbadmintoncryer
authored
feat(sagemaker): network isolation for a model (#30657)
### Issue # (if applicable) None ### Reason for this change SageMaker model supports for the [network isolation](https://docs.aws.amazon.com/sagemaker/latest/dg/mkt-algo-model-internet-free.html) function. But Model construct does not support this. ### Description of changes Add `networkIsolation` to `ModelProps` ```ts const model = new sagemaker.Model(this, 'ContainerModel', { containers: [ { image, modelData, } ], networkIsolation: true, // Added }); ``` ### Description of how you validated changes Added both unit and integ tests ### Checklist - [x] My code adheres to the [CONTRIBUTING GUIDE](https://github.com/aws/aws-cdk/blob/main/CONTRIBUTING.md) and [DESIGN GUIDELINES](https://github.com/aws/aws-cdk/blob/main/docs/DESIGN_GUIDELINES.md) ---- *By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*
1 parent 5b3b2d1 commit f1af7fc

File tree

8 files changed

+477
-13
lines changed

8 files changed

+477
-13
lines changed

‎packages/@aws-cdk/aws-sagemaker-alpha/README.md

+25
Original file line numberDiff line numberDiff line change
@@ -78,6 +78,31 @@ const model = new sagemaker.Model(this, 'InferencePipelineModel', {
7878
});
7979
```
8080

81+
### Model Properties
82+
83+
#### Network Isolation
84+
85+
If you enable [network isolation](https://docs.aws.amazon.com/sagemaker/latest/dg/mkt-algo-model-internet-free.html), the containers can't make any outbound network calls, even to other AWS services such as Amazon S3. Additionally, no AWS credentials are made available to the container runtime environment.
86+
87+
To enable network isolation, set the `networkIsolation` property to `true`:
88+
89+
```typescript
90+
import * as sagemaker from '@aws-cdk/aws-sagemaker-alpha';
91+
92+
declare const image: sagemaker.ContainerImage;
93+
declare const modelData: sagemaker.ModelData;
94+
95+
const model = new sagemaker.Model(this, 'ContainerModel', {
96+
containers: [
97+
{
98+
image,
99+
modelData,
100+
}
101+
],
102+
networkIsolation: true,
103+
});
104+
```
105+
81106
### Container Images
82107

83108
Inference code can be stored in the Amazon EC2 Container Registry (Amazon ECR), which is specified

‎packages/@aws-cdk/aws-sagemaker-alpha/lib/model.ts

+12
Original file line numberDiff line numberDiff line change
@@ -206,6 +206,17 @@ export interface ModelProps {
206206
* @default true
207207
*/
208208
readonly allowAllOutbound?: boolean;
209+
210+
/**
211+
* Whether to enable network isolation for the model container.
212+
*
213+
* When enabled, no inbound or outbound network calls can be made to or from the model container.
214+
*
215+
* @see https://docs.aws.amazon.com/sagemaker/latest/dg/mkt-algo-model-internet-free.html
216+
*
217+
* @default false
218+
*/
219+
readonly networkIsolation?: boolean;
209220
}
210221

211222
/**
@@ -312,6 +323,7 @@ export class Model extends ModelBase {
312323
primaryContainer: cdk.Lazy.any({ produce: () => this.renderPrimaryContainer() }),
313324
vpcConfig: cdk.Lazy.any({ produce: () => this.renderVpcConfig() }),
314325
containers: cdk.Lazy.any({ produce: () => this.renderContainers() }),
326+
enableNetworkIsolation: props.networkIsolation,
315327
});
316328
this.modelName = this.getResourceNameAttribute(model.attrModelName);
317329
this.modelArn = this.getResourceArnAttribute(model.ref, {

‎packages/@aws-cdk/aws-sagemaker-alpha/test/integ.model.js.snapshot/aws-cdk-sagemaker-model.assets.json

+2-2
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎packages/@aws-cdk/aws-sagemaker-alpha/test/integ.model.js.snapshot/aws-cdk-sagemaker-model.template.json

+163
Original file line numberDiff line numberDiff line change
@@ -898,6 +898,169 @@
898898
"HuggingFaceModelRoleDefaultPolicy50587D35",
899899
"HuggingFaceModelRoleDA17DA00"
900900
]
901+
},
902+
"NetworkIsolationModelRole562D6C7F": {
903+
"Type": "AWS::IAM::Role",
904+
"Properties": {
905+
"AssumeRolePolicyDocument": {
906+
"Statement": [
907+
{
908+
"Action": "sts:AssumeRole",
909+
"Effect": "Allow",
910+
"Principal": {
911+
"Service": "sagemaker.amazonaws.com"
912+
}
913+
}
914+
],
915+
"Version": "2012-10-17"
916+
},
917+
"ManagedPolicyArns": [
918+
{
919+
"Fn::Join": [
920+
"",
921+
[
922+
"arn:",
923+
{
924+
"Ref": "AWS::Partition"
925+
},
926+
":iam::aws:policy/AmazonSageMakerFullAccess"
927+
]
928+
]
929+
}
930+
]
931+
}
932+
},
933+
"NetworkIsolationModelRoleDefaultPolicy84ACFE88": {
934+
"Type": "AWS::IAM::Policy",
935+
"Properties": {
936+
"PolicyDocument": {
937+
"Statement": [
938+
{
939+
"Action": [
940+
"ecr:BatchCheckLayerAvailability",
941+
"ecr:BatchGetImage",
942+
"ecr:GetDownloadUrlForLayer"
943+
],
944+
"Effect": "Allow",
945+
"Resource": {
946+
"Fn::Join": [
947+
"",
948+
[
949+
"arn:",
950+
{
951+
"Ref": "AWS::Partition"
952+
},
953+
":ecr:",
954+
{
955+
"Ref": "AWS::Region"
956+
},
957+
":",
958+
{
959+
"Ref": "AWS::AccountId"
960+
},
961+
":repository/",
962+
{
963+
"Fn::Sub": "cdk-hnb659fds-container-assets-${AWS::AccountId}-${AWS::Region}"
964+
}
965+
]
966+
]
967+
}
968+
},
969+
{
970+
"Action": "ecr:GetAuthorizationToken",
971+
"Effect": "Allow",
972+
"Resource": "*"
973+
},
974+
{
975+
"Action": [
976+
"s3:GetBucket*",
977+
"s3:GetObject*",
978+
"s3:List*"
979+
],
980+
"Effect": "Allow",
981+
"Resource": [
982+
{
983+
"Fn::Join": [
984+
"",
985+
[
986+
"arn:",
987+
{
988+
"Ref": "AWS::Partition"
989+
},
990+
":s3:::",
991+
{
992+
"Fn::Sub": "cdk-hnb659fds-assets-${AWS::AccountId}-${AWS::Region}"
993+
},
994+
"/*"
995+
]
996+
]
997+
},
998+
{
999+
"Fn::Join": [
1000+
"",
1001+
[
1002+
"arn:",
1003+
{
1004+
"Ref": "AWS::Partition"
1005+
},
1006+
":s3:::",
1007+
{
1008+
"Fn::Sub": "cdk-hnb659fds-assets-${AWS::AccountId}-${AWS::Region}"
1009+
}
1010+
]
1011+
]
1012+
}
1013+
]
1014+
}
1015+
],
1016+
"Version": "2012-10-17"
1017+
},
1018+
"PolicyName": "NetworkIsolationModelRoleDefaultPolicy84ACFE88",
1019+
"Roles": [
1020+
{
1021+
"Ref": "NetworkIsolationModelRole562D6C7F"
1022+
}
1023+
]
1024+
}
1025+
},
1026+
"NetworkIsolationModel29FE9107": {
1027+
"Type": "AWS::SageMaker::Model",
1028+
"Properties": {
1029+
"Containers": [
1030+
{
1031+
"Image": {
1032+
"Fn::Sub": "${AWS::AccountId}.dkr.ecr.${AWS::Region}.${AWS::URLSuffix}/cdk-hnb659fds-container-assets-${AWS::AccountId}-${AWS::Region}:442a71de95281cb26bd41da567c79060206108b97bdde93cb4ce5f213f50013a"
1033+
}
1034+
},
1035+
{
1036+
"Image": {
1037+
"Fn::Sub": "${AWS::AccountId}.dkr.ecr.${AWS::Region}.${AWS::URLSuffix}/cdk-hnb659fds-container-assets-${AWS::AccountId}-${AWS::Region}:442a71de95281cb26bd41da567c79060206108b97bdde93cb4ce5f213f50013a"
1038+
},
1039+
"ModelDataUrl": {
1040+
"Fn::Sub": "https://s3.${AWS::Region}.${AWS::URLSuffix}/cdk-hnb659fds-assets-${AWS::AccountId}-${AWS::Region}/126d48fa0e32fbef5078b9d88658b35ad29d4291eb86675a64c75fa4f1338916.gz"
1041+
}
1042+
},
1043+
{
1044+
"Image": {
1045+
"Fn::Sub": "${AWS::AccountId}.dkr.ecr.${AWS::Region}.${AWS::URLSuffix}/cdk-hnb659fds-container-assets-${AWS::AccountId}-${AWS::Region}:442a71de95281cb26bd41da567c79060206108b97bdde93cb4ce5f213f50013a"
1046+
},
1047+
"ModelDataUrl": {
1048+
"Fn::Sub": "https://s3.${AWS::Region}.${AWS::URLSuffix}/cdk-hnb659fds-assets-${AWS::AccountId}-${AWS::Region}/126d48fa0e32fbef5078b9d88658b35ad29d4291eb86675a64c75fa4f1338916.gz"
1049+
}
1050+
}
1051+
],
1052+
"EnableNetworkIsolation": true,
1053+
"ExecutionRoleArn": {
1054+
"Fn::GetAtt": [
1055+
"NetworkIsolationModelRole562D6C7F",
1056+
"Arn"
1057+
]
1058+
}
1059+
},
1060+
"DependsOn": [
1061+
"NetworkIsolationModelRoleDefaultPolicy84ACFE88",
1062+
"NetworkIsolationModelRole562D6C7F"
1063+
]
9011064
}
9021065
},
9031066
"Mappings": {

‎packages/@aws-cdk/aws-sagemaker-alpha/test/integ.model.js.snapshot/manifest.json

+19-1
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

0 commit comments

Comments
 (0)