pangea 0.0.45 → 0.0.47

data/lib/pangea/resources/aws_sagemaker_notebook_instance/types/validators.rb

@@ -0,0 +1,97 @@
+# frozen_string_literal: true
+
+# Copyright 2025 The Pangea Authors
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+module Pangea
+  module Resources
+    module AWS
+      module SageMakerNotebookInstance
+        # Validation logic for SageMaker Notebook Instance attributes
+        module Validators
+          RESERVED_NAMES = %w[sagemaker aws amazon].freeze
+          INCOMPATIBLE_ACCELERATOR_PREFIXES = %w[ml.t ml.m4 ml.c4].freeze
+          REPO_URL_PATTERN = /\A(https:\/\/github\.com\/|https:\/\/git-codecommit\.[a-z0-9-]+\.amazonaws\.com\/|arn:aws:sagemaker:)/.freeze
+          KMS_KEY_PATTERN = /\A(arn:aws:kms:|alias\/|[a-f0-9-]{36})/.freeze
+
+          def self.validate!(attrs)
+            validate_instance_name(attrs[:instance_name])
+            validate_vpc_configuration(attrs[:subnet_id], attrs[:direct_internet_access])
+            validate_security_groups(attrs[:security_group_ids], attrs[:subnet_id])
+            validate_kms_key(attrs[:kms_key_id])
+            validate_accelerator_compatibility(attrs[:accelerator_types], attrs[:instance_type])
+            validate_code_repositories(attrs[:default_code_repository], attrs[:additional_code_repositories])
+            validate_volume_configuration(attrs[:volume_type], attrs[:volume_size_in_gb])
+          end
+
+          def self.validate_instance_name(name)
+            return unless name
+
+            if RESERVED_NAMES.any? { |reserved| name.downcase.include?(reserved) }
+              raise Dry::Struct::Error, "Instance name cannot contain reserved words: #{RESERVED_NAMES.join(', ')}"
+            end
+          end
+
+          def self.validate_vpc_configuration(subnet_id, direct_internet_access)
+            if subnet_id.nil? && direct_internet_access == 'Disabled'
+              raise Dry::Struct::Error, 'direct_internet_access cannot be Disabled without specifying subnet_id'
+            end
+          end
+
+          def self.validate_security_groups(security_group_ids, subnet_id)
+            if security_group_ids&.any? && subnet_id.nil?
+              raise Dry::Struct::Error, 'security_group_ids can only be specified when subnet_id is provided'
+            end
+          end
+
+          def self.validate_kms_key(kms_key_id)
+            return unless kms_key_id
+            return if kms_key_id.match?(KMS_KEY_PATTERN)
+
+            raise Dry::Struct::Error, 'kms_key_id must be a valid KMS key ARN, alias, or key ID'
+          end
+
+          def self.validate_accelerator_compatibility(accelerator_types, instance_type)
+            return unless accelerator_types&.any?
+
+            if INCOMPATIBLE_ACCELERATOR_PREFIXES.any? { |prefix| instance_type&.start_with?(prefix) }
+              raise Dry::Struct::Error, "Elastic Inference accelerators are not compatible with #{instance_type}"
+            end
+          end
+
+          def self.validate_code_repositories(default_repo, additional_repos)
+            all_repos = []
+            all_repos << default_repo if default_repo
+            all_repos.concat(additional_repos || [])
+
+            all_repos.each do |repo|
+              next if repo.match?(REPO_URL_PATTERN)
+
+              raise Dry::Struct::Error, 'Code repository must be a GitHub URL, CodeCommit URL, or SageMaker Git repo ARN'
+            end
+          end
+
+          def self.validate_volume_configuration(volume_type, volume_size)
+            return unless %w[io1 io2].include?(volume_type)
+
+            volume_size ||= 20
+            return unless volume_size < 10
+
+            raise Dry::Struct::Error, "Volume size must be at least 10GB for #{volume_type} volume type"
+          end
+        end
+      end
+    end
+  end
+end

data/lib/pangea/resources/aws_sagemaker_notebook_instance/types.rb

@@ -1,4 +1,5 @@
 # frozen_string_literal: true
+
 # Copyright 2025 The Pangea Authors
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
@@ -13,9 +14,12 @@
 # See the License for the specific language governing permissions and
 # limitations under the License.
 
-
 require 'dry-struct'
 require 'pangea/resources/types'
+require_relative 'types/validators'
+require_relative 'types/pricing'
+require_relative 'types/helpers'
+require_relative 'types/security'
 
 module Pangea
   module Resources
@@ -35,23 +39,35 @@ module Pangea
           'ml.p2.xlarge', 'ml.p2.8xlarge', 'ml.p2.16xlarge',
           'ml.p3.2xlarge', 'ml.p3.8xlarge', 'ml.p3.16xlarge'
         )
-        
+
         # SageMaker Notebook Instance volume types
         SageMakerNotebookVolumeType = String.enum('gp2', 'gp3', 'io1', 'io2')
-        
+
         # SageMaker Notebook Instance platform identifier
         SageMakerNotebookPlatformIdentifier = String.enum('notebook-al1-v1', 'notebook-al2-v1', 'notebook-al2-v2')
-        
+
         # SageMaker Notebook Instance root access
         SageMakerNotebookRootAccess = String.enum('Enabled', 'Disabled').default('Enabled')
-        
+
         # SageMaker Notebook Instance status
-        SageMakerNotebookInstanceStatus = String.enum('Pending', 'InService', 'Stopping', 'Stopped', 'Failed', 'Deleting', 'Updating')
-        
+        SageMakerNotebookInstanceStatus = String.enum(
+          'Pending', 'InService', 'Stopping', 'Stopped', 'Failed', 'Deleting', 'Updating'
+        )
+
+        # Accelerator types enum
+        SageMakerAcceleratorType = String.enum(
+          'ml.eia1.medium', 'ml.eia1.large', 'ml.eia1.xlarge',
+          'ml.eia2.medium', 'ml.eia2.large', 'ml.eia2.xlarge'
+        )
+
         # SageMaker Notebook Instance attributes with comprehensive validation
         class SageMakerNotebookInstanceAttributes < Dry::Struct
+          include SageMakerNotebookInstance::Pricing
+          include SageMakerNotebookInstance::Helpers
+          include SageMakerNotebookInstance::Security
+
           transform_keys(&:to_sym)
-          
+
           # Required attributes
           attribute :instance_name, Resources::Types::String.constrained(
             min_size: 1,
@@ -62,7 +78,7 @@ module Pangea
           attribute :role_arn, Resources::Types::String.constrained(
             format: /\Aarn:aws:iam::\d{12}:role\/[a-zA-Z0-9_+=,.@-]+\z/
           )
-          
+
           # Optional attributes
           attribute :subnet_id, Resources::Types::String.optional
           attribute :security_group_ids, Resources::Types::Array.of(String).optional
@@ -71,7 +87,7 @@ module Pangea
           attribute :direct_internet_access, String.enum('Enabled', 'Disabled').default('Enabled')
           attribute :volume_size_in_gb, Integer.constrained(gteq: 5, lteq: 16384).default(20)
           attribute :volume_type, SageMakerNotebookVolumeType.default('gp2')
-          attribute :accelerator_types, Resources::Types::Array.of(String.enum('ml.eia1.medium', 'ml.eia1.large', 'ml.eia1.xlarge', 'ml.eia2.medium', 'ml.eia2.large', 'ml.eia2.xlarge')).optional
+          attribute :accelerator_types, Resources::Types::Array.of(SageMakerAcceleratorType).optional
           attribute :default_code_repository, Resources::Types::String.optional
           attribute :additional_code_repositories, Resources::Types::Array.of(String).optional
           attribute :root_access, SageMakerNotebookRootAccess
@@ -80,242 +96,15 @@ module Pangea
             minimum_instance_metadata_service_version: String.enum('1', '2').default('1')
           ).optional
           attribute :tags, Resources::Types::AwsTags
-          
+
           # Custom validation for SageMaker Notebook Instance
           def self.new(attributes)
             attrs = attributes.is_a?(Hash) ? attributes : {}
-            
-            # Validate instance name doesn't conflict with reserved names
-            if attrs[:instance_name]
-              reserved_names = ['sagemaker', 'aws', 'amazon']
-              if reserved_names.any? { |reserved| attrs[:instance_name].downcase.include?(reserved) }
-                raise Dry::Struct::Error, "Instance name cannot contain reserved words: #{reserved_names.join(', ')}"
-              end
-            end
-            
-            # Validate VPC configuration consistency
-            subnet_id = attrs[:subnet_id]
-            direct_internet_access = attrs[:direct_internet_access]
-            
-            if subnet_id && direct_internet_access == 'Enabled'
-              # Warn but don't fail - user might have configured NAT gateway
-              # In production, you might want to validate the subnet has internet access
-            end
-            
-            if subnet_id.nil? && direct_internet_access == 'Disabled'
-              raise Dry::Struct::Error, "direct_internet_access cannot be Disabled without specifying subnet_id"
-            end
-            
-            # Validate security groups are only allowed with VPC
-            if attrs[:security_group_ids] && attrs[:security_group_ids].any? && subnet_id.nil?
-              raise Dry::Struct::Error, "security_group_ids can only be specified when subnet_id is provided"
-            end
-            
-            # Validate KMS key format
-            if attrs[:kms_key_id]
-              unless attrs[:kms_key_id] =~ /\A(arn:aws:kms:|alias\/|[a-f0-9-]{36})/
-                raise Dry::Struct::Error, "kms_key_id must be a valid KMS key ARN, alias, or key ID"
-              end
-            end
-            
-            # Validate accelerator types are compatible with instance type
-            if attrs[:accelerator_types] && attrs[:accelerator_types].any?
-              instance_type = attrs[:instance_type]
-              if instance_type&.start_with?('ml.t') || instance_type&.start_with?('ml.m4') || instance_type&.start_with?('ml.c4')
-                raise Dry::Struct::Error, "Elastic Inference accelerators are not compatible with #{instance_type}"
-              end
-            end
-            
-            # Validate code repository URLs
-            all_repos = []
-            all_repos << attrs[:default_code_repository] if attrs[:default_code_repository]
-            all_repos.concat(attrs[:additional_code_repositories] || [])
-            
-            all_repos.each do |repo|
-              unless repo =~ /\A(https:\/\/github\.com\/|https:\/\/git-codecommit\.[a-z0-9-]+\.amazonaws\.com\/|arn:aws:sagemaker:)/
-                raise Dry::Struct::Error, "Code repository must be a GitHub URL, CodeCommit URL, or SageMaker Git repo ARN"
-              end
-            end
-            
-            # Validate volume configuration
-            if attrs[:volume_type] == 'io1' || attrs[:volume_type] == 'io2'
-              # For IOPS volumes, validate size makes sense
-              volume_size = attrs[:volume_size_in_gb] || 20
-              if volume_size < 10
-                raise Dry::Struct::Error, "Volume size must be at least 10GB for #{attrs[:volume_type]} volume type"
-              end
-            end
-            
+            SageMakerNotebookInstance::Validators.validate!(attrs)
             super(attrs)
           end
-          
-          # Computed properties
-          def estimated_monthly_cost
-            instance_cost = get_instance_cost_per_hour * 24 * 30
-            storage_cost = volume_size_in_gb * 0.10 # $0.10 per GB per month
-            accelerator_cost = get_accelerator_cost_per_hour * 24 * 30
-            
-            instance_cost + storage_cost + accelerator_cost
-          end
-          
-          def get_instance_cost_per_hour
-            # Simplified pricing - real implementation would use AWS pricing API
-            case instance_type
-            when /^ml\.t/
-              case instance_type
-              when 'ml.t2.medium' then 0.0464
-              when 'ml.t2.large' then 0.0928
-              when 'ml.t2.xlarge' then 0.1856
-              when 'ml.t2.2xlarge' then 0.3712
-              when 'ml.t3.medium' then 0.0548
-              when 'ml.t3.large' then 0.1096
-              when 'ml.t3.xlarge' then 0.2192
-              when 'ml.t3.2xlarge' then 0.4384
-              else 0.1
-              end
-            when /^ml\.m/
-              case instance_type
-              when /xl/ then instance_type.include?('2xl') ? 0.8 : 0.4
-              when /4xl/ then 1.6
-              when /8xl/ then 3.2
-              else 0.2
-              end
-            when /^ml\.c/
-              case instance_type
-              when /xl/ then instance_type.include?('2xl') ? 0.6 : 0.3
-              when /4xl/ then 1.2
-              when /8xl/ then 2.4
-              else 0.15
-              end
-            when /^ml\.r/
-              case instance_type
-              when /xl/ then instance_type.include?('2xl') ? 1.0 : 0.5
-              when /4xl/ then 2.0
-              when /8xl/ then 4.0
-              else 0.25
-              end
-            when /^ml\.p/
-              case instance_type
-              when 'ml.p2.xlarge' then 0.9
-              when 'ml.p2.8xlarge' then 7.2
-              when 'ml.p2.16xlarge' then 14.4
-              when 'ml.p3.2xlarge' then 3.06
-              when 'ml.p3.8xlarge' then 12.24
-              when 'ml.p3.16xlarge' then 24.48
-              else 1.0
-              end
-            else
-              0.1
-            end
-          end
-          
-          def get_accelerator_cost_per_hour
-            return 0.0 unless accelerator_types && accelerator_types.any?
-            
-            accelerator_types.sum do |accelerator|
-              case accelerator
-              when 'ml.eia1.medium' then 0.13
-              when 'ml.eia1.large' then 0.26
-              when 'ml.eia1.xlarge' then 0.52
-              when 'ml.eia2.medium' then 0.14
-              when 'ml.eia2.large' then 0.28
-              when 'ml.eia2.xlarge' then 0.56
-              else 0.0
-              end
-            end
-          end
-          
-          def is_gpu_instance?
-            instance_type.start_with?('ml.p')
-          end
-          
-          def is_compute_optimized?
-            instance_type.start_with?('ml.c')
-          end
-          
-          def is_memory_optimized?
-            instance_type.start_with?('ml.r')
-          end
-          
-          def is_burstable?
-            instance_type.start_with?('ml.t')
-          end
-          
-          def has_vpc_configuration?
-            !subnet_id.nil?
-          end
-          
-          def has_internet_access?
-            direct_internet_access == 'Enabled'
-          end
-          
-          def has_accelerators?
-            accelerator_types && accelerator_types.any?
-          end
-          
-          def uses_custom_kms_key?
-            !kms_key_id.nil?
-          end
-          
-          def has_lifecycle_config?
-            !lifecycle_config_name.nil?
-          end
-          
-          def has_code_repositories?
-            !default_code_repository.nil? || (additional_code_repositories && additional_code_repositories.any?)
-          end
-          
-          def total_code_repositories
-            count = 0
-            count += 1 if default_code_repository
-            count += additional_code_repositories.size if additional_code_repositories
-            count
-          end
-          
-          # Security assessment
-          def security_score
-            score = 0
-            score += 20 if has_vpc_configuration? && !has_internet_access?
-            score += 15 if uses_custom_kms_key?
-            score += 10 if root_access == 'Disabled'
-            score += 10 if has_lifecycle_config?
-            score += 10 if platform_identifier == 'notebook-al2-v2' # Latest platform
-            score += 15 if instance_metadata_service_configuration&.dig(:minimum_instance_metadata_service_version) == '2'
-            score += 5 if security_group_ids && security_group_ids.any?
-            
-            [score, 100].min
-          end
-          
-          def compliance_status
-            issues = []
-            issues << "Notebook has direct internet access" if has_internet_access? && has_vpc_configuration?
-            issues << "No custom KMS key for encryption" unless uses_custom_kms_key?
-            issues << "Root access is enabled" if root_access == 'Enabled'
-            issues << "No lifecycle configuration specified" unless has_lifecycle_config?
-            issues << "Using older platform identifier" if platform_identifier && platform_identifier != 'notebook-al2-v2'
-            issues << "Instance metadata service v1 allowed" unless instance_metadata_service_configuration&.dig(:minimum_instance_metadata_service_version) == '2'
-            
-            {
-              status: issues.empty? ? 'compliant' : 'needs_attention',
-              issues: issues
-            }
-          end
-          
-          # Instance capability summary
-          def instance_capabilities
-            {
-              instance_type: instance_type,
-              gpu_enabled: is_gpu_instance?,
-              compute_optimized: is_compute_optimized?,
-              memory_optimized: is_memory_optimized?,
-              burstable: is_burstable?,
-              accelerators: accelerator_types || [],
-              storage_gb: volume_size_in_gb,
-              estimated_monthly_cost: estimated_monthly_cost
-            }
-          end
         end
       end
     end
   end
-end
+end

data/lib/pangea/resources/aws_sagemaker_training_job/types/attributes.rb

@@ -0,0 +1,86 @@
+# frozen_string_literal: true
+
+# Copyright 2025 The Pangea Authors. Licensed under Apache 2.0.
+
+module Pangea
+  module Resources
+    module AWS
+      module Types
+        class SageMakerTrainingJobAttributes < Dry::Struct
+          transform_keys(&:to_sym)
+
+          attribute :training_job_name, Resources::Types::String.constrained(min_size: 1, max_size: 63, format: /\A[a-zA-Z0-9][a-zA-Z0-9\-]*[a-zA-Z0-9]\z/)
+          attribute :role_arn, Resources::Types::String.constrained(format: /\Aarn:aws:iam::\d{12}:role\/[a-zA-Z0-9_+=,.@-]+\z/)
+          attribute :algorithm_specification, Resources::Types::Hash
+          attribute :input_data_config, Resources::Types::Array.of(SageMakerTrainingInputDataConfig).constrained(min_size: 1, max_size: 20)
+          attribute :output_data_config, SageMakerTrainingOutputDataConfig
+          attribute :resource_config, SageMakerTrainingResourceConfig
+          attribute :stopping_condition, SageMakerTrainingStoppingCondition
+          attribute :hyper_parameters, Resources::Types::Hash.map(String, String).optional
+          attribute :vpc_config, SageMakerTrainingVpcConfig.optional
+          attribute :checkpoint_config, SageMakerTrainingCheckpointConfig.optional
+          attribute :debug_hook_config, SageMakerTrainingDebugHookConfig.optional
+          attribute :debug_rule_configurations, Resources::Types::Array.of(Hash).optional
+          attribute :profiler_config, SageMakerTrainingProfilerConfig.optional
+          attribute :profiler_rule_configurations, Resources::Types::Array.of(Hash).optional
+          attribute :experiment_config, Resources::Types::Hash.optional
+          attribute :tensor_board_output_config, Resources::Types::Hash.optional
+          attribute :enable_network_isolation, Resources::Types::Bool.default(false)
+          attribute :enable_inter_container_traffic_encryption, Resources::Types::Bool.default(false)
+          attribute :enable_managed_spot_training, Resources::Types::Bool.default(false)
+          attribute :retry_strategy, Resources::Types::Hash.optional
+          attribute :environment, Resources::Types::Hash.map(String, String).optional
+          attribute :tags, Resources::Types::AwsTags
+
+          def self.new(attributes)
+            attrs = attributes.is_a?(Hash) ? attributes : {}
+            SageMakerValidation.validate(attrs)
+            super(attrs)
+          end
+
+          def is_distributed_training? = resource_config[:instance_count] > 1
+          def is_gpu_training? = resource_config[:instance_type].match?(/ml\.(p|g)/)
+          def uses_spot_training? = enable_managed_spot_training
+          def uses_network_isolation? = enable_network_isolation
+          def uses_vpc? = !vpc_config.nil?
+          def has_checkpoints? = !checkpoint_config.nil?
+          def has_debugging? = !debug_hook_config.nil? || debug_rule_configurations&.any?
+          def has_profiling? = !profiler_config.nil? || profiler_rule_configurations&.any?
+          def has_tensorboard? = !tensor_board_output_config.nil?
+          def has_experiment_tracking? = !experiment_config.nil?
+          def uses_encryption? = enable_inter_container_traffic_encryption || !resource_config[:volume_kms_key_id].nil? || !output_data_config[:kms_key_id].nil?
+          def input_channel_count = input_data_config.size
+          def metric_definition_count = algorithm_specification[:metric_definitions]&.size || 0
+          def hyperparameter_count = hyper_parameters&.size || 0
+          def max_runtime_hours = (stopping_condition[:max_runtime_in_seconds] || 86_400) / 3600.0
+
+          def estimated_training_cost
+            instance_cost = SageMakerCostCalculator.instance_cost(resource_config[:instance_type]) * resource_config[:instance_count]
+            storage_cost = (resource_config[:volume_size_in_gb] * 0.10) / (24 * 30)
+            total = (instance_cost + storage_cost) * max_runtime_hours
+            enable_managed_spot_training ? total * 0.3 : total
+          end
+
+          def training_capabilities
+            { distributed: is_distributed_training?, gpu_enabled: is_gpu_training?, spot_training: uses_spot_training?,
+              network_isolated: uses_network_isolation?, vpc_enabled: uses_vpc?, checkpointing: has_checkpoints?,
+              debugging: has_debugging?, profiling: has_profiling?, tensorboard: has_tensorboard?, experiment_tracking: has_experiment_tracking?, encrypted: uses_encryption? }
+          end
+
+          def security_score
+            score = 0
+            score += 20 if uses_network_isolation?
+            score += 15 if uses_vpc?
+            score += 10 if enable_inter_container_traffic_encryption
+            score += 10 if resource_config[:volume_kms_key_id]
+            score += 10 if output_data_config[:kms_key_id]
+            score += 15 if has_checkpoints? && uses_spot_training?
+            score += 10 if has_debugging? || has_profiling?
+            score += 10 if retry_strategy&.dig(:maximum_retry_attempts).to_i > 1
+            [score, 100].min
+          end
+        end
+      end
+    end
+  end
+end

data/lib/pangea/resources/aws_sagemaker_training_job/types/configs.rb

@@ -0,0 +1,38 @@
+# frozen_string_literal: true
+
+# Copyright 2025 The Pangea Authors. Licensed under Apache 2.0.
+
+module Pangea
+  module Resources
+    module AWS
+      module Types
+        SageMakerTrainingDataSource = Hash.schema(
+          s3_data_source: Hash.schema(s3_data_type: String.enum('ManifestFile', 'S3Prefix', 'AugmentedManifestFile'),
+                                       s3_uri: String.constrained(format: /\As3:\/\//),
+                                       s3_data_distribution_type?: String.enum('FullyReplicated', 'ShardedByS3Key').default('FullyReplicated'),
+                                       attribute_names?: Array.of(String).optional)
+        )
+
+        SageMakerTrainingInputDataConfig = Hash.schema(
+          channel_name: String.constrained(min_size: 1, max_size: 64, format: /\A[a-zA-Z0-9\-]+\z/),
+          data_source: SageMakerTrainingDataSource, content_type?: SageMakerTrainingContentType.optional,
+          compression_type?: SageMakerTrainingCompressionType.default('None'), record_wrapper_type?: String.enum('None', 'RecordIO').default('None'),
+          input_mode?: SageMakerTrainingInputMode.default('File'), shuffle_config?: Hash.schema(seed: Integer.constrained(gteq: 0, lteq: 4_294_967_295)).optional
+        )
+
+        SageMakerTrainingOutputDataConfig = Hash.schema(kms_key_id?: String.optional, s3_output_path: String.constrained(format: /\As3:\/\//))
+        SageMakerTrainingResourceConfig = Hash.schema(instance_count: Integer.constrained(gteq: 1, lteq: 100), instance_type: SageMakerTrainingInstanceType,
+                                                       volume_size_in_gb: Integer.constrained(gteq: 1, lteq: 16_384), volume_kms_key_id?: String.optional)
+        SageMakerTrainingStoppingCondition = Hash.schema(max_runtime_in_seconds?: Integer.constrained(gteq: 1, lteq: 432_000).default(86_400))
+        SageMakerTrainingVpcConfig = Hash.schema(security_group_ids: Array.of(String).constrained(min_size: 1, max_size: 5),
+                                                  subnets: Array.of(String).constrained(min_size: 1, max_size: 16))
+        SageMakerTrainingCheckpointConfig = Hash.schema(s3_uri: String.constrained(format: /\As3:\/\//), local_path?: String.default('/opt/ml/checkpoints'))
+        SageMakerTrainingDebugHookConfig = Hash.schema(local_path?: String.default('/opt/ml/output/tensors'), s3_output_path: String.constrained(format: /\As3:\/\//),
+                                                        hook_parameters?: Hash.map(String, String).optional, collection_configurations?: Array.of(Hash).optional)
+        SageMakerTrainingProfilerConfig = Hash.schema(s3_output_path?: String.constrained(format: /\As3:\/\//).optional,
+                                                       profiling_interval_in_milliseconds?: Integer.constrained(gteq: 100, lteq: 3_600_000).default(500),
+                                                       profiling_parameters?: Hash.map(String, String).optional)
+      end
+    end
+  end
+end

data/lib/pangea/resources/aws_sagemaker_training_job/types/enums.rb

@@ -0,0 +1,27 @@
+# frozen_string_literal: true
+
+# Copyright 2025 The Pangea Authors. Licensed under Apache 2.0.
+
+module Pangea
+  module Resources
+    module AWS
+      module Types
+        SageMakerTrainingInstanceType = String.enum(
+          'ml.m4.xlarge', 'ml.m4.2xlarge', 'ml.m4.4xlarge', 'ml.m4.10xlarge', 'ml.m4.16xlarge',
+          'ml.m5.large', 'ml.m5.xlarge', 'ml.m5.2xlarge', 'ml.m5.4xlarge', 'ml.m5.12xlarge', 'ml.m5.24xlarge', 'ml.m5.48xlarge',
+          'ml.c4.xlarge', 'ml.c4.2xlarge', 'ml.c4.4xlarge', 'ml.c4.8xlarge',
+          'ml.c5.xlarge', 'ml.c5.2xlarge', 'ml.c5.4xlarge', 'ml.c5.9xlarge', 'ml.c5.18xlarge',
+          'ml.c5n.xlarge', 'ml.c5n.2xlarge', 'ml.c5n.4xlarge', 'ml.c5n.9xlarge', 'ml.c5n.18xlarge',
+          'ml.r5.large', 'ml.r5.xlarge', 'ml.r5.2xlarge', 'ml.r5.4xlarge', 'ml.r5.12xlarge', 'ml.r5.24xlarge',
+          'ml.p2.xlarge', 'ml.p2.8xlarge', 'ml.p2.16xlarge', 'ml.p3.2xlarge', 'ml.p3.8xlarge', 'ml.p3.16xlarge',
+          'ml.p3dn.24xlarge', 'ml.p4d.24xlarge',
+          'ml.g4dn.xlarge', 'ml.g4dn.2xlarge', 'ml.g4dn.4xlarge', 'ml.g4dn.8xlarge', 'ml.g4dn.12xlarge', 'ml.g4dn.16xlarge'
+        )
+        SageMakerTrainingInputMode = String.enum('File', 'Pipe')
+        SageMakerTrainingCompressionType = String.enum('None', 'Gzip')
+        SageMakerTrainingContentType = String.enum('text/csv', 'text/libsvm', 'application/x-parquet', 'application/json',
+                                                    'application/jsonlines', 'application/x-recordio-protobuf', 'application/x-image', 'application/x-numpy')
+      end
+    end
+  end
+end

data/lib/pangea/resources/aws_sagemaker_training_job/types/validation.rb

@@ -0,0 +1,70 @@
+# frozen_string_literal: true
+
+# Copyright 2025 The Pangea Authors. Licensed under Apache 2.0.
+
+module Pangea
+  module Resources
+    module AWS
+      module Types
+        module SageMakerValidation
+          def self.validate(attrs)
+            validate_algorithm(attrs[:algorithm_specification])
+            validate_channels(attrs[:input_data_config])
+            validate_spot_config(attrs)
+            validate_vpc_isolation(attrs)
+            validate_distributed(attrs)
+            validate_hyperparameters(attrs[:hyper_parameters])
+          end
+
+          def self.validate_algorithm(algo_spec)
+            return unless algo_spec
+            has_image, has_algorithm = algo_spec[:training_image], algo_spec[:algorithm_name]
+            raise Dry::Struct::Error, 'Either training_image or algorithm_name must be specified' if !has_image && !has_algorithm
+            raise Dry::Struct::Error, 'Cannot specify both training_image and algorithm_name' if has_image && has_algorithm
+            algo_spec[:metric_definitions]&.each_with_index do |metric, i|
+              Regexp.new(metric[:regex])
+            rescue RegexpError => e
+              raise Dry::Struct::Error, "Metric definition #{i}: Invalid regex '#{metric[:regex]}': #{e.message}"
+            end
+          end
+
+          def self.validate_channels(input_data_config)
+            return unless input_data_config
+            names = input_data_config.map { |c| c[:channel_name] }
+            raise Dry::Struct::Error, 'Input data channel names must be unique' if names.uniq.size != names.size
+          end
+
+          def self.validate_spot_config(attrs)
+            return unless attrs[:enable_managed_spot_training]
+            max_runtime = attrs.dig(:stopping_condition, :max_runtime_in_seconds)
+            raise Dry::Struct::Error, 'Managed spot training max runtime cannot exceed 48 hours (172800 seconds)' if max_runtime.to_i > 172_800
+          end
+
+          def self.validate_vpc_isolation(attrs)
+            raise Dry::Struct::Error, 'VPC configuration cannot be specified when network isolation is enabled' if attrs[:enable_network_isolation] && attrs[:vpc_config]
+          end
+
+          def self.validate_distributed(attrs)
+            return unless attrs.dig(:resource_config, :instance_count).to_i > 1
+            attrs[:input_data_config]&.each do |config|
+              raise Dry::Struct::Error, 'Pipe input mode is not supported for distributed training (instance_count > 1)' if config[:input_mode] == 'Pipe'
+            end
+          end
+
+          def self.validate_hyperparameters(params)
+            params&.each { |key, value| raise Dry::Struct::Error, "Hyperparameter '#{key}' value exceeds maximum length of 2500 characters" if value.length > 2500 }
+          end
+        end
+
+        module SageMakerCostCalculator
+          COSTS = { 'ml.m4' => 0.20, 'ml.m5.large' => 0.115, 'ml.m5.xlarge' => 0.23, 'ml.m5.2xlarge' => 0.46, 'ml.c4' => 0.15, 'ml.c5' => 0.20,
+                    'ml.p2.xlarge' => 0.90, 'ml.p3.2xlarge' => 3.06, 'ml.p3.8xlarge' => 12.24, 'ml.p3.16xlarge' => 24.48, 'ml.g4dn' => 1.20 }.freeze
+
+          def self.instance_cost(type)
+            COSTS.find { |k, _| type.start_with?(k) }&.last || 0.25
+          end
+        end
+      end
+    end
+  end
+end