@aws/ml-container-creator 0.9.1 → 0.10.3

package/bin/cli.js

@@ -168,11 +168,13 @@ program
     .option('--region <region>', 'AWS region')
     .option('--role-arn <arn>', 'Existing IAM role ARN to use')
     .option('--non-interactive', 'Run without prompts (requires --profile and --region)')
+    .option('--name <name>', 'Bootstrap profile name (default: "default")')
     .option('--force', 'Force removal without confirmation')
     .option('--verify', 'Verify resources exist (for status)')
     .option('--delete-stack', 'Delete CloudFormation stack on remove')
     .option('--ignore-staleness', 'Suppress schema staleness warnings')
     .option('--ci', 'Provision CI integration infrastructure')
+    .option('--benchmark-infra', 'Provision Athena/Glue benchmark infrastructure (requires --ci)')
     .option('--skip-ci', 'Skip CI infrastructure provisioning')
     .option('--skip-s3', 'Skip S3 bucket creation')
     .option('--skip-post-setup', 'Skip post-setup chain (mcp init, sync-architectures, sync-schemas)')

package/config/bootstrap-e2e-stack.json

@@ -0,0 +1,341 @@
+{
+    "AWSTemplateFormatVersion": "2010-09-09",
+    "Description": "ML Container Creator — E2E validation infrastructure (CodeBuild project, EventBridge schedules, S3 results bucket, SNS notifications). Separate lifecycle from main bootstrap stack.",
+
+    "Parameters": {
+        "SourceType": {
+            "Type": "String",
+            "Default": "NO_SOURCE",
+            "AllowedValues": ["NO_SOURCE", "CODECOMMIT", "GITHUB", "S3"],
+            "Description": "Source provider for the CodeBuild project. Use NO_SOURCE if buildspec handles checkout."
+        },
+        "SourceLocation": {
+            "Type": "String",
+            "Default": "",
+            "Description": "Source location (repo URL or S3 path). Leave empty for NO_SOURCE."
+        }
+    },
+
+    "Conditions": {
+        "HasSource": { "Fn::Not": [{ "Fn::Equals": [{ "Ref": "SourceType" }, "NO_SOURCE"] }] }
+    },
+
+    "Resources": {
+        "E2ECodeBuildRole": {
+            "Type": "AWS::IAM::Role",
+            "Properties": {
+                "RoleName": "mlcc-e2e-codebuild-role",
+                "AssumeRolePolicyDocument": {
+                    "Version": "2012-10-17",
+                    "Statement": [
+                        {
+                            "Effect": "Allow",
+                            "Principal": { "Service": "codebuild.amazonaws.com" },
+                            "Action": "sts:AssumeRole"
+                        }
+                    ]
+                },
+                "Policies": [
+                    {
+                        "PolicyName": "mlcc-e2e-codebuild-policy",
+                        "PolicyDocument": {
+                            "Version": "2012-10-17",
+                            "Statement": [
+                                {
+                                    "Sid": "CloudWatchLogs",
+                                    "Effect": "Allow",
+                                    "Action": [
+                                        "logs:CreateLogGroup",
+                                        "logs:CreateLogStream",
+                                        "logs:PutLogEvents"
+                                    ],
+                                    "Resource": { "Fn::Sub": "arn:aws:logs:${AWS::Region}:${AWS::AccountId}:log-group:/aws/codebuild/ml-container-creator-e2e*" }
+                                },
+                                {
+                                    "Sid": "SageMakerAccess",
+                                    "Effect": "Allow",
+                                    "Action": [
+                                        "sagemaker:CreateEndpoint",
+                                        "sagemaker:CreateEndpointConfig",
+                                        "sagemaker:CreateModel",
+                                        "sagemaker:DeleteEndpoint",
+                                        "sagemaker:DeleteEndpointConfig",
+                                        "sagemaker:DeleteModel",
+                                        "sagemaker:DescribeEndpoint",
+                                        "sagemaker:DescribeEndpointConfig",
+                                        "sagemaker:DescribeModel",
+                                        "sagemaker:InvokeEndpoint",
+                                        "sagemaker:ListEndpoints"
+                                    ],
+                                    "Resource": "*"
+                                },
+                                {
+                                    "Sid": "ECRAccess",
+                                    "Effect": "Allow",
+                                    "Action": [
+                                        "ecr:GetAuthorizationToken",
+                                        "ecr:BatchCheckLayerAvailability",
+                                        "ecr:GetDownloadUrlForLayer",
+                                        "ecr:BatchGetImage",
+                                        "ecr:PutImage",
+                                        "ecr:InitiateLayerUpload",
+                                        "ecr:UploadLayerPart",
+                                        "ecr:CompleteLayerUpload",
+                                        "ecr:CreateRepository",
+                                        "ecr:DescribeRepositories"
+                                    ],
+                                    "Resource": "*"
+                                },
+                                {
+                                    "Sid": "S3ResultsAccess",
+                                    "Effect": "Allow",
+                                    "Action": [
+                                        "s3:GetObject",
+                                        "s3:PutObject",
+                                        "s3:ListBucket"
+                                    ],
+                                    "Resource": [
+                                        { "Fn::Sub": "arn:aws:s3:::mlcc-e2e-results-${AWS::AccountId}-${AWS::Region}" },
+                                        { "Fn::Sub": "arn:aws:s3:::mlcc-e2e-results-${AWS::AccountId}-${AWS::Region}/*" }
+                                    ]
+                                },
+                                {
+                                    "Sid": "SNSPublish",
+                                    "Effect": "Allow",
+                                    "Action": "sns:Publish",
+                                    "Resource": { "Fn::Sub": "arn:aws:sns:${AWS::Region}:${AWS::AccountId}:mlcc-e2e-notifications" }
+                                },
+                                {
+                                    "Sid": "IAMPassRole",
+                                    "Effect": "Allow",
+                                    "Action": "iam:PassRole",
+                                    "Resource": { "Fn::Sub": "arn:aws:iam::${AWS::AccountId}:role/mlcc-sagemaker-execution-role" },
+                                    "Condition": {
+                                        "StringEquals": {
+                                            "iam:PassedToService": "sagemaker.amazonaws.com"
+                                        }
+                                    }
+                                },
+                                {
+                                    "Sid": "ServiceQuotas",
+                                    "Effect": "Allow",
+                                    "Action": [
+                                        "service-quotas:GetServiceQuota",
+                                        "service-quotas:ListServiceQuotas"
+                                    ],
+                                    "Resource": "*"
+                                }
+                            ]
+                        }
+                    }
+                ],
+                "Tags": [
+                    { "Key": "mlcc:managed-by", "Value": "ml-container-creator" },
+                    { "Key": "mlcc:created-by", "Value": "bootstrap-e2e" }
+                ]
+            }
+        },
+
+        "E2ECodeBuildProject": {
+            "Type": "AWS::CodeBuild::Project",
+            "Properties": {
+                "Name": "ml-container-creator-e2e",
+                "Description": "E2E validation runner for ML Container Creator — runs catalog configs through full lifecycle",
+                "ServiceRole": { "Fn::GetAtt": ["E2ECodeBuildRole", "Arn"] },
+                "TimeoutInMinutes": 480,
+                "Environment": {
+                    "Type": "LINUX_CONTAINER",
+                    "ComputeType": "BUILD_GENERAL1_LARGE",
+                    "Image": "aws/codebuild/standard:7.0",
+                    "PrivilegedMode": true,
+                    "EnvironmentVariables": [
+                        {
+                            "Name": "TIER",
+                            "Value": "ci",
+                            "Type": "PLAINTEXT"
+                        }
+                    ]
+                },
+                "Source": {
+                    "Type": { "Ref": "SourceType" },
+                    "BuildSpec": "version: 0.2\nphases:\n  install:\n    runtime-versions:\n      nodejs: 20\n  build:\n    commands:\n      - npm ci\n      - node scripts/e2e-runner.js --tier $TIER\n"
+                },
+                "Artifacts": {
+                    "Type": "NO_ARTIFACTS"
+                },
+                "LogsConfig": {
+                    "CloudWatchLogs": {
+                        "Status": "ENABLED",
+                        "GroupName": "/aws/codebuild/ml-container-creator-e2e"
+                    }
+                },
+                "Tags": [
+                    { "Key": "mlcc:managed-by", "Value": "ml-container-creator" },
+                    { "Key": "mlcc:created-by", "Value": "bootstrap-e2e" }
+                ]
+            }
+        },
+
+        "E2EEventBridgeRole": {
+            "Type": "AWS::IAM::Role",
+            "Properties": {
+                "RoleName": "mlcc-e2e-eventbridge-role",
+                "AssumeRolePolicyDocument": {
+                    "Version": "2012-10-17",
+                    "Statement": [
+                        {
+                            "Effect": "Allow",
+                            "Principal": { "Service": "events.amazonaws.com" },
+                            "Action": "sts:AssumeRole"
+                        }
+                    ]
+                },
+                "Policies": [
+                    {
+                        "PolicyName": "mlcc-e2e-eventbridge-policy",
+                        "PolicyDocument": {
+                            "Version": "2012-10-17",
+                            "Statement": [
+                                {
+                                    "Effect": "Allow",
+                                    "Action": "codebuild:StartBuild",
+                                    "Resource": { "Fn::GetAtt": ["E2ECodeBuildProject", "Arn"] }
+                                }
+                            ]
+                        }
+                    }
+                ],
+                "Tags": [
+                    { "Key": "mlcc:managed-by", "Value": "ml-container-creator" },
+                    { "Key": "mlcc:created-by", "Value": "bootstrap-e2e" }
+                ]
+            }
+        },
+
+        "E2ECIDailyRule": {
+            "Type": "AWS::Events::Rule",
+            "Metadata": {
+                "MigrationNote": "Renamed from E2ECIHourlyRule to E2ECIDailyRule. Renaming the logical resource ID causes CloudFormation to delete the old rule and create a new one. This is intentional as the schedule changed from hourly to daily."
+            },
+            "Properties": {
+                "Name": "e2e-ci-daily",
+                "Description": "Triggers E2E CI tier validation daily at 6am UTC",
+                "ScheduleExpression": "cron(0 6 * * ? *)",
+                "State": "ENABLED",
+                "Targets": [
+                    {
+                        "Id": "e2e-codebuild-ci",
+                        "Arn": { "Fn::GetAtt": ["E2ECodeBuildProject", "Arn"] },
+                        "RoleArn": { "Fn::GetAtt": ["E2EEventBridgeRole", "Arn"] },
+                        "Input": "{\"environmentVariablesOverride\":[{\"name\":\"TIER\",\"value\":\"ci\",\"type\":\"PLAINTEXT\"}]}"
+                    }
+                ]
+            }
+        },
+
+        "E2ENightlyRule": {
+            "Type": "AWS::Events::Rule",
+            "Properties": {
+                "Name": "e2e-nightly",
+                "Description": "Triggers E2E nightly tier validation at 2am UTC daily",
+                "ScheduleExpression": "cron(0 2 * * ? *)",
+                "State": "ENABLED",
+                "Targets": [
+                    {
+                        "Id": "e2e-codebuild-nightly",
+                        "Arn": { "Fn::GetAtt": ["E2ECodeBuildProject", "Arn"] },
+                        "RoleArn": { "Fn::GetAtt": ["E2EEventBridgeRole", "Arn"] },
+                        "Input": "{\"environmentVariablesOverride\":[{\"name\":\"TIER\",\"value\":\"nightly\",\"type\":\"PLAINTEXT\"}]}"
+                    }
+                ]
+            }
+        },
+
+        "E2EWeeklyRule": {
+            "Type": "AWS::Events::Rule",
+            "Properties": {
+                "Name": "e2e-weekly",
+                "Description": "Triggers E2E weekly tier validation at 2am UTC every Sunday",
+                "ScheduleExpression": "cron(0 2 ? * SUN *)",
+                "State": "ENABLED",
+                "Targets": [
+                    {
+                        "Id": "e2e-codebuild-weekly",
+                        "Arn": { "Fn::GetAtt": ["E2ECodeBuildProject", "Arn"] },
+                        "RoleArn": { "Fn::GetAtt": ["E2EEventBridgeRole", "Arn"] },
+                        "Input": "{\"environmentVariablesOverride\":[{\"name\":\"TIER\",\"value\":\"weekly\",\"type\":\"PLAINTEXT\"}]}"
+                    }
+                ]
+            }
+        },
+
+        "E2EResultsBucket": {
+            "Type": "AWS::S3::Bucket",
+            "DeletionPolicy": "Retain",
+            "UpdateReplacePolicy": "Retain",
+            "Properties": {
+                "BucketName": { "Fn::Sub": "mlcc-e2e-results-${AWS::AccountId}-${AWS::Region}" },
+                "VersioningConfiguration": { "Status": "Enabled" },
+                "BucketEncryption": {
+                    "ServerSideEncryptionConfiguration": [
+                        { "ServerSideEncryptionByDefault": { "SSEAlgorithm": "AES256" } }
+                    ]
+                },
+                "LifecycleConfiguration": {
+                    "Rules": [
+                        {
+                            "Id": "ExpireOldResults",
+                            "Status": "Enabled",
+                            "ExpirationInDays": 90
+                        }
+                    ]
+                },
+                "Tags": [
+                    { "Key": "mlcc:managed-by", "Value": "ml-container-creator" },
+                    { "Key": "mlcc:created-by", "Value": "bootstrap-e2e" },
+                    { "Key": "mlcc:purpose", "Value": "e2e-validation-results" }
+                ]
+            }
+        },
+
+        "E2ENotificationsTopic": {
+            "Type": "AWS::SNS::Topic",
+            "Properties": {
+                "TopicName": "mlcc-e2e-notifications",
+                "DisplayName": "ML Container Creator E2E Validation Alerts",
+                "Tags": [
+                    { "Key": "mlcc:managed-by", "Value": "ml-container-creator" },
+                    { "Key": "mlcc:created-by", "Value": "bootstrap-e2e" },
+                    { "Key": "mlcc:purpose", "Value": "e2e-failure-alerts" }
+                ]
+            }
+        }
+    },
+
+    "Outputs": {
+        "CodeBuildProjectName": {
+            "Description": "E2E CodeBuild project name",
+            "Value": { "Ref": "E2ECodeBuildProject" }
+        },
+        "CodeBuildProjectArn": {
+            "Description": "E2E CodeBuild project ARN",
+            "Value": { "Fn::GetAtt": ["E2ECodeBuildProject", "Arn"] }
+        },
+        "ResultsBucketName": {
+            "Description": "S3 bucket for E2E validation results",
+            "Value": { "Ref": "E2EResultsBucket" }
+        },
+        "NotificationsTopicArn": {
+            "Description": "SNS topic ARN for E2E failure notifications",
+            "Value": { "Ref": "E2ENotificationsTopic" }
+        },
+        "CodeBuildRoleArn": {
+            "Description": "IAM role ARN used by the E2E CodeBuild project",
+            "Value": { "Fn::GetAtt": ["E2ECodeBuildRole", "Arn"] }
+        },
+        "StackVersion": {
+            "Description": "Bootstrap E2E stack template version",
+            "Value": "2026-06-01"
+        }
+    }
+}

package/config/bootstrap-stack.json

@@ -13,12 +13,19 @@
       "Type": "String",
       "Default": "",
       "Description": "ARN of an existing IAM role to use instead of creating one. Leave empty to create a new role."
+    },
+    "SkipEcrCreation": {
+      "Type": "String",
+      "Default": "false",
+      "AllowedValues": ["true", "false"],
+      "Description": "Skip ECR repository creation when it already exists. Set to 'true' to avoid ResourceExistenceCheck failures."
     }
   },
 
   "Conditions": {
     "ShouldCreateS3Buckets": { "Fn::Equals": [{ "Ref": "CreateS3Buckets" }, "true"] },
-    "ShouldCreateRole": { "Fn::Equals": [{ "Ref": "UseExistingRoleArn" }, ""] }
+    "ShouldCreateRole": { "Fn::Equals": [{ "Ref": "UseExistingRoleArn" }, ""] },
+    "ShouldCreateEcr": { "Fn::Equals": [{ "Ref": "SkipEcrCreation" }, "false"] }
   },
 
   "Resources": {
@@ -77,6 +84,11 @@
                     "sagemaker:ListAIBenchmarkJobs",
                     "sagemaker:StopAIBenchmarkJob",
                     "sagemaker:DeleteAIBenchmarkJob",
+                    "sagemaker:CreateAIRecommendationJob",
+                    "sagemaker:DescribeAIRecommendationJob",
+                    "sagemaker:ListAIRecommendationJobs",
+                    "sagemaker:StopAIRecommendationJob",
+                    "sagemaker:DeleteAIRecommendationJob",
                     "sagemaker:CreateAIWorkloadConfig",
                     "sagemaker:DescribeAIWorkloadConfig",
                     "sagemaker:ListAIWorkloadConfigs",
@@ -201,6 +213,9 @@
                     "sagemaker:DescribeModelPackage",
                     "sagemaker:DescribeModelPackageGroup",
                     "sagemaker:ListModelPackages",
+                    "sagemaker:ListHubContents",
+                    "sagemaker:DescribeHubContent",
+                    "sagemaker:DescribeHub",
                     "sagemaker:CallMlflowAppApi"
                   ],
                   "Resource": "*"
@@ -208,9 +223,28 @@
                 {
                   "Sid": "SageMakerMLflow",
                   "Effect": "Allow",
-                  "Action": "sagemaker-mlflow:*",
+                  "Action": [
+                    "sagemaker:ListMlflowApps",
+                    "sagemaker:ListMlflowTrackingServers",
+                    "sagemaker:DescribeMlflowTrackingServer",
+                    "sagemaker:CreatePresignedMlflowTrackingServerUrl",
+                    "sagemaker:DescribeApp",
+                    "sagemaker:ListApps"
+                  ],
                   "Resource": "*"
                 },
+                {
+                  "Sid": "SageMakerMlflowAppAccess",
+                  "Effect": "Allow",
+                  "Action": [
+                    "sagemaker:UpdateMlflowApp",
+                    "sagemaker:DescribeMlflowApp",
+                    "sagemaker:CreatePresignedMlflowAppUrl",
+                    "sagemaker:CallMlflowAppApi",
+                    "sagemaker-mlflow:*"
+                  ],
+                  "Resource": { "Fn::Sub": "arn:aws:sagemaker:*:${AWS::AccountId}:mlflow-app/*" }
+                },
                 {
                   "Sid": "LambdaInvokeForReward",
                   "Effect": "Allow",
@@ -230,6 +264,7 @@
 
     "EcrRepository": {
       "Type": "AWS::ECR::Repository",
+      "Condition": "ShouldCreateEcr",
       "Properties": {
         "RepositoryName": "ml-container-creator",
         "ImageScanningConfiguration": { "ScanOnPush": true },
@@ -361,10 +396,12 @@
       }
     },
     "EcrRepositoryName": {
+      "Condition": "ShouldCreateEcr",
       "Description": "ECR repository name",
       "Value": { "Ref": "EcrRepository" }
     },
     "EcrRepositoryUri": {
+      "Condition": "ShouldCreateEcr",
       "Description": "ECR repository URI",
       "Value": { "Fn::GetAtt": ["EcrRepository", "RepositoryUri"] }
     },
@@ -395,7 +432,7 @@
     },
     "StackVersion": {
       "Description": "Bootstrap stack template version for forward compatibility tracking",
-      "Value": "2026-05-18"
+      "Value": "2026-05-28"
     }
   }
 }