apac-ml-tfc / frugal-mlops Goto Github PK

This repository demonstrates examples of experiment-driven pipelines to push new model ideas into deployment, but doesn't show a corresponding data-driven pipeline to refresh trained models as new data arrives.

By replacing our Lambda-calling states with style e.g.

"Hello": {
  "Type": "Task",
  "Resource": "arn:aws:lambda:us-east-1:xxxxxxxxx:function:HelloWorld:$LATEST",
  "ResultPath": "$.LambdaResult",
  "Next": "World"
},

...we can reference results at $.LambdaResult instead of $.LambdaResult.Payload, and not pollute the step function data with other Lambda execution metadata e.g. the called version, HTTP headers etc which appear at the moment.

Although the sandbox.yml stack grants the user's execution role permission to sts:AssumeRole on the SudoRole, the SudoRole's trust policy is not updated to add the new principal - so the access is still blocked... Resulting in an error something like the below at the end of notebook 1:

An error occurred (AccessDenied) when calling the AssumeRole operation: User: arn:aws:sts::123456789012:assumed-role/AmazonSageMaker-ExecutionRole-XYZ/SageMaker is not authorized to perform: sts:AssumeRole on resource: arn:aws:iam::123456789012:role/forestcover/forestcover-ProjectSudoRole

The manual fix is to open the SudoRole in the IAM console, go to the "Trust Relationships" tab, and add an entry something like:

    {
      "Effect": "Allow",
      "Principal": {
        "AWS": "arn:aws:iam::123456789012:role/AmazonSageMaker-ExecutionRole-XYZ"
      },
      "Action": "sts:AssumeRole"
    }

...But the templates should be updated to automate this process