@aws-solutions-constructs/aws-lambda-sagemaker

aws-lambda-sagemaker module

---

All classes are under active development and subject to non-backward compatible changes or removal in any future version. These are not subject to the Semantic Versioning model. This means that while you may use them, you may need to update your source code when upgrading to a newer version of this package.

---

Reference Documentation:	https://docs.aws.amazon.com/solutions/latest/constructs/

Language	Package
Python	aws_solutions_constructs.aws_lambda_sagemaker
Typescript	@aws-solutions-constructs/aws-lambda-sagemaker
Java	software.amazon.awsconstructs.services.lambdasagemaker

This AWS Solutions Construct implements the AWS Lambda function and Amazon Sagemaker Notebook with the least privileged permissions.

Here is a minimal deployable pattern definition in Typescript:

import { LambdaToSagemakerProps,  LambdaToSagemaker } from '@aws-solutions-constructs/aws-lambda-sagemaker';
import { Aws } from "@aws-cdk/core";

const lambdaToSagemakerProps: LambdaToSagemakerProps = {
    lambdaFunctionProps: {
        code: lambda.Code.fromAsset(`${__dirname}/lambda`),
        runtime: lambda.Runtime.NODEJS_12_X,
        handler: 'index.handler'
    },
};

const construct = new LambdaToSagemaker(stack, 'test-lambda-sagemaker-stack', lambdaToSagemakerProps);

// // Add the necessary permissions to the SageMakerRole for accessing other AWS Resources e.g. S3 Bucket
// construct.sagemakerRole.addToPolicy(new iam.PolicyStatement({
//     resources: [`arn:${Aws.PARTITION}:s3:::<Your bucket name>/*`],
//     actions: [
//         "s3:GetObject*",
//         "s3:PutObject*",
//     ],
// }));

// // Add the necessary permissions to the Lambda Function Role e.g. additional SageMaker permissions
// construct.lambdaFunction.role?.addToPrincipalPolicy(new iam.PolicyStatement({
//     resources: [`arn:${Aws.PARTITION}:sagemaker:${Aws.REGION}:${Aws.ACCOUNT_ID}:transform-job/*`],
//     actions: [
//         "sagemaker:CreateTransformJob",
//     ],
// }));

Initializer

new LambdaToSagemaker(scope: Construct, id: string, props: LambdaToSagemakerProps);

Parameters

• scope Construct
• id string
• props LambdaToSagemakerProps

Pattern Construct Props

Name	Type	Description
existingLambdaObj?	lambda.Function	Existing instance of Lambda Function object, if this is set then the lambdaFunctionProps is ignored.
lambdaFunctionProps?	lambda.FunctionProps	User provided props to override the default props for the Lambda function.
sagemakerNotebookProps?	sagemaker.CfnNotebookInstanceProps	Optional user provided props to override the default props for a Sagemaker Notebook.
deployInsideVpc?	boolean	Optional user provided props to deploy inside vpc. Defaults to true.
existingNotebookObj?	sagemaker.CfnNotebookInstanceProps	Existing instance of notebook object. If this is set then the sagemakerNotebookProps is ignored

Pattern Properties

Name	Type	Description
lambdaFunction	lambda.Function	Returns an instance of lambda.Function created by the construct
sagemakerNotebook	sagemaker.CfnNotebookInstanceProps	Returns an instance of sagemaker.CfnNotebookInstanceProps created by the construct
sagemakerRole	iam.Role	Returns the iam.Role created by the construct
vpc?	ec2.Vpc	Returns the ec2.Vpc created by the construct
securityGroup?	ec2.SecurityGroup	Returns the ec2.SecurityGroup created by the construct

Default settings

Out of the box implementation of the Construct without any override will set the following defaults:

AWS Lambda Function

• Configure limited privilege access IAM role for Lambda function
• Enable reusing connections with Keep-Alive for NodeJs Lambda function

Amazon SageMaker

• Configure least privilege access IAM role for the SageMaker Notebook Intance
• Deploy SageMaker NotebookInstance inside the VPC
• Enable server-side encryption for the SageMaker NotebookInstance using Customer Managed KMS Key

Architecture

---

© Copyright 2020 Amazon.com, Inc. or its affiliates. All Rights Reserved.