workbench 0.8.165__tar.gz → 0.8.167__tar.gz

{workbench-0.8.165 → workbench-0.8.167}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: workbench
-Version: 0.8.165
+Version: 0.8.167
 Summary: Workbench: A Dashboard and Python API for creating and deploying AWS SageMaker Model Pipelines
 Author-email: SuperCowPowers LLC <support@supercowpowers.com>
 License-Expression: MIT
@@ -30,7 +30,7 @@ Requires-Dist: joblib>=1.3.2
 Requires-Dist: requests>=2.26.0
 Requires-Dist: rdkit>=2024.9.5
 Requires-Dist: mordredcommunity>=2.0.6
-Requires-Dist: workbench-bridges>=0.1.8
+Requires-Dist: workbench-bridges>=0.1.10
 Provides-Extra: ui
 Requires-Dist: plotly>=6.0.0; extra == "ui"
 Requires-Dist: dash>3.0.0; extra == "ui"

{workbench-0.8.165 → workbench-0.8.167}/applications/aws_dashboard/Dockerfile

@@ -7,7 +7,7 @@ EXPOSE 8000
 ENV PYTHONHASHSEED=0
 
 # Define workbench version
-ARG WORKBENCH_VERSION=0.8.159
+ARG WORKBENCH_VERSION=0.8.165
 
 # Install system packages and gunicorn in one layer
 RUN apt-get update && apt-get install -y --no-install-recommends \

{workbench-0.8.165 → workbench-0.8.167}/applications/aws_dashboard/pages/data_sources/layout.py

@@ -58,6 +58,7 @@ def data_sources_layout(
                             data_source_details,
                             type="dot",
                             color="#33aa33",
+                            delay_show=300,
                         ),
                         width=4,
                         className="text-break workbench-container",
@@ -67,12 +68,12 @@ def data_sources_layout(
                     dbc.Col(
                         [
                             dbc.Row(
-                                dcc.Loading(violin_plot, type="graph"),
+                                dcc.Loading(violin_plot, type="graph", delay_show=500),
                                 className="workbench-container",
                                 style={"margin": "20px 0px 10px 20px"},
                             ),
                             dbc.Row(
-                                dcc.Loading(correlation_matrix, type="graph"),
+                                dcc.Loading(correlation_matrix, type="graph", delay_show=500),
                                 className="workbench-container",
                                 style={"margin": "20px 0px 10px 20px"},
                             ),

{workbench-0.8.165 → workbench-0.8.167}/applications/aws_dashboard/pages/endpoints/layout.py

@@ -47,7 +47,7 @@ def endpoints_layout(
                 [
                     # Column 1: Endpoint Details
                     dbc.Col(
-                        dcc.Loading(endpoint_details, type="dot", color="#33aa33"),
+                        dcc.Loading(endpoint_details, type="dot", color="#33aa33", delay_show=300),
                         width=4,
                         className="text-break workbench-container",
                         style={"margin": "20px 0px 0px 0px", "padding": "20px"},
@@ -56,7 +56,7 @@ def endpoints_layout(
                     dbc.Col(
                         [
                             dbc.Row(
-                                dcc.Loading(endpoint_metrics, type="graph"),
+                                dcc.Loading(endpoint_metrics, type="graph", delay_show=500),
                                 className="workbench-container",
                                 style={"margin": "20px 0px 10px 20px"},
                             ),

{workbench-0.8.165 → workbench-0.8.167}/applications/aws_dashboard/pages/feature_sets/layout.py

@@ -46,11 +46,7 @@ def feature_sets_layout(
                 [
                     # Column 1: Feature Set Details
                     dbc.Col(
-                        dcc.Loading(
-                            feature_set_details,
-                            type="dot",
-                            color="#33aa33",
-                        ),
+                        dcc.Loading(feature_set_details, type="dot", color="#33aa33", delay_show=300),
                         width=4,
                         className="text-break workbench-container",
                         style={"margin": "20px 0px 0px 0px", "padding": "20px"},
@@ -59,12 +55,12 @@ def feature_sets_layout(
                     dbc.Col(
                         [
                             dbc.Row(
-                                dcc.Loading(violin_plot, type="graph"),
+                                dcc.Loading(violin_plot, type="graph", delay_show=500),
                                 className="workbench-container",
                                 style={"margin": "20px 0px 10px 20px"},
                             ),
                             dbc.Row(
-                                dcc.Loading(correlation_matrix, type="graph"),
+                                dcc.Loading(correlation_matrix, type="graph", delay_show=500),
                                 className="workbench-container",
                                 style={"margin": "20px 0px 10px 20px"},
                             ),

{workbench-0.8.165 → workbench-0.8.167}/applications/aws_dashboard/pages/models/layout.py

@@ -37,11 +37,7 @@ def models_layout(
                 [
                     # Column 1: Model Details
                     dbc.Col(
-                        dcc.Loading(
-                            model_details,
-                            type="dot",
-                            color="#33aa33",
-                        ),
+                        dcc.Loading(model_details, type="dot", color="#33aa33", delay_show=300),
                         width=5,
                         className="text-break workbench-container",
                         style={"margin": "20px 0px 0px 0px", "padding": "20px"},
@@ -50,12 +46,12 @@ def models_layout(
                     dbc.Col(
                         [
                             dbc.Row(
-                                dcc.Loading(model_plot, type="graph", style={"height": "400px"}),
+                                dcc.Loading(model_plot, type="graph", delay_show=500, style={"height": "400px"}),
                                 className="workbench-container",
                                 style={"margin": "20px 0px 10px 20px"},
                             ),
                             dbc.Row(
-                                dcc.Loading(shap_plot, type="graph"),
+                                dcc.Loading(shap_plot, type="graph", delay_show=500),
                                 className="workbench-container",
                                 style={"margin": "20px 0px 10px 20px"},
                             ),

{workbench-0.8.165 → workbench-0.8.167}/aws_setup/aws_account_check.py

@@ -65,9 +65,9 @@ class AWSAccountCheck:
             self.log.info(str(feature_group))
         print("\n")
 
-        # Check that the Glue Database exist
-        self.log.info("*** AWS Glue Database Check ***")
-        for catalog_db in ["workbench", "sagemaker_featurestore"]:
+        # Check that the Glue Databases exist
+        self.log.info("*** AWS Glue Databases Check ***")
+        for catalog_db in ["workbench", "sagemaker_featurestore", "inference_store"]:
             self.ensure_aws_catalog_db(catalog_db)
         print("\n")
 

{workbench-0.8.165 → workbench-0.8.167}/aws_setup/workbench_core/workbench_core/workbench_core_stack.py

@@ -1,4 +1,12 @@
-from aws_cdk import Environment, Stack, aws_iam as iam, aws_logs as logs, RemovalPolicy
+from aws_cdk import (
+    Environment,
+    Stack,
+    aws_iam as iam,
+    aws_logs as logs,
+    aws_ec2 as ec2,
+    aws_batch as batch,
+    RemovalPolicy,
+)
 from constructs import Construct
 from typing import Any, List
 from dataclasses import dataclass, field
@@ -21,7 +29,7 @@ class WorkbenchCoreStack(Stack):
         **kwargs: Any,
     ) -> None:
         desc = "Workbench Core: Defines the core Workbench resources, roles, and policies for the Workbench API."
-        super().__init__(scope, construct_id, description=desc, **kwargs)
+        super().__init__(scope, construct_id, env=env, description=desc, **kwargs)
 
         # Print the environment details
         print("Environment")
@@ -37,7 +45,7 @@ class WorkbenchCoreStack(Stack):
         self.readonly_role_name = "Workbench-ReadOnlyRole"  # Read only operations
         self.glue_role_name = "Workbench-GlueRole"
         self.lambda_role_name = "Workbench-LambdaRole"
-        self.training_role_name = "Workbench-TrainingRole"
+        self.batch_role_name = "Workbench-BatchRole"
 
         # Create the WorkbenchLogGroup for CloudWatch Logs
         self.workbench_log_group = logs.LogGroup(
@@ -64,6 +72,12 @@ class WorkbenchCoreStack(Stack):
         self.endpoint_read_policy = self.workbench_endpoint_read_policy()
         self.endpoint_policy = self.workbench_endpoint_policy()
         self.pipeline_policy = self.workbench_pipeline_policy()
+        self.dataframe_store_read_policy = self.workbench_dataframe_store_read_policy()
+        self.dataframe_store_full_policy = self.workbench_dataframe_store_full_policy()
+        self.parameter_store_read_policy = self.workbench_parameter_store_read_policy()
+        self.parameter_store_full_policy = self.workbench_parameter_store_full_policy()
+        self.inference_store_read_policy = self.workbench_inference_store_read_policy()
+        self.inference_store_full_policy = self.workbench_inference_store_full_policy()
 
         # Create our main Workbench API Execution Role
         self.workbench_execution_role = self.create_execution_role()
@@ -71,9 +85,14 @@ class WorkbenchCoreStack(Stack):
         # Create a read-only role for the Workbench API
         self.workbench_readonly_role = self.create_readonly_role()
 
-        # Create additional roles for Lambda and Glue
+        # Create additional roles for Lambda, Glue, and Batch
         self.workbench_lambda_role = self.create_lambda_role()
         self.workbench_glue_role = self.create_glue_role()
+        self.workbench_batch_role = self.create_batch_role()
+
+        # Batch Compute Environment and Job Queue
+        self.batch_compute_environment = self.create_batch_compute_environment()
+        self.batch_job_queue = self.create_batch_job_queue()
 
     ####################
     #    S3 Buckets    #
@@ -172,7 +191,7 @@ class WorkbenchCoreStack(Stack):
                 "glue:GetPartition",
                 "glue:GetPartitions",
             ],
-            resources=self._workbench_database_arns(),
+            resources=self._workbench_database_arns() + self._inference_database_arns(),
         )
 
     def glue_databases_full(self) -> iam.PolicyStatement:
@@ -185,16 +204,21 @@ class WorkbenchCoreStack(Stack):
                 "glue:UpdateTable",
                 "glue:DeleteTable",
             ],
-            resources=self._workbench_database_arns(),
+            resources=self._workbench_database_arns() + self._inference_database_arns(),
         )
 
     def _workbench_database_arns(self) -> list[str]:
-        """Helper to get all Workbench-managed database/table ARNs."""
+        """Helper to get Workbench-managed database/table ARNs."""
         return [
             f"arn:aws:glue:{self.region}:{self.account}:database/workbench",
             f"arn:aws:glue:{self.region}:{self.account}:table/workbench/*",
             f"arn:aws:glue:{self.region}:{self.account}:database/sagemaker_featurestore",
             f"arn:aws:glue:{self.region}:{self.account}:table/sagemaker_featurestore/*",
+        ]
+
+    def _inference_database_arns(self) -> list[str]:
+        """Helper to get inference store database/table ARNs."""
+        return [
             f"arn:aws:glue:{self.region}:{self.account}:database/inference_store",
             f"arn:aws:glue:{self.region}:{self.account}:table/inference_store/*",
         ]
@@ -220,12 +244,22 @@ class WorkbenchCoreStack(Stack):
             ],
         )
 
-    def glue_pass_role(self) -> iam.PolicyStatement:
-        """Allows us to specify the Workbench-Glue role when creating a Glue Job"""
+    def glue_connections(self) -> iam.PolicyStatement:
+        """Create a policy statement for Glue connection access.
+
+        Returns:
+            iam.PolicyStatement: The policy statement for Glue connection interactions.
+        """
         return iam.PolicyStatement(
-            actions=["iam:PassRole"],
-            resources=[f"arn:aws:iam::{self.account}:role/Workbench-GlueRole"],
-            conditions={"StringEquals": {"iam:PassedToService": "glue.amazonaws.com"}},
+            actions=[
+                "glue:GetConnection",
+            ],
+            resources=[
+                # GetConnection requires access to the catalog resource since the
+                # Glue Catalog is used for metadata storage and connection retrieval
+                f"arn:aws:glue:{self.region}:{self.account}:catalog",
+                f"arn:aws:glue:{self.region}:{self.account}:connection/*",
+            ],
         )
 
     @staticmethod
@@ -260,6 +294,208 @@ class WorkbenchCoreStack(Stack):
             resources=read_statement.resources,
         )
 
+    def glue_pass_role(self) -> iam.PolicyStatement:
+        """Allows us to specify the Workbench-Glue role when creating a Glue Job"""
+        return iam.PolicyStatement(
+            actions=["iam:PassRole"],
+            resources=[f"arn:aws:iam::{self.account}:role/{self.glue_role_name}"],
+            conditions={"StringEquals": {"iam:PassedToService": "glue.amazonaws.com"}},
+        )
+
+    ##################
+    #   Batch Jobs   #
+    ##################
+    def batch_job_logs(self) -> iam.PolicyStatement:
+        """Create a policy statement for Glue job CloudWatch logs.
+
+        Returns:
+            iam.PolicyStatement: The policy statement for Glue job log interactions.
+        """
+        return iam.PolicyStatement(
+            actions=[
+                "logs:CreateLogGroup",
+                "logs:CreateLogStream",
+                "logs:PutLogEvents",
+            ],
+            resources=[
+                f"arn:aws:logs:{self.region}:{self.account}:log-group:/aws/batch/job",
+                f"arn:aws:logs:{self.region}:{self.account}:log-group:/aws/batch/job:*",
+            ],
+        )
+
+    @staticmethod
+    def batch_jobs_discover() -> iam.PolicyStatement:
+        """Discovery actions that absolutely require * resource."""
+        return iam.PolicyStatement(
+            actions=[
+                "batch:ListJobs",  # Requires * to list across all queues
+                "batch:DescribeJobs",  # Requires * even for specific job IDs (AWS API design)
+            ],
+            resources=["*"],
+        )
+
+    def batch_jobs_read(self) -> iam.PolicyStatement:
+        """Read-only access to specific Batch resources."""
+        return iam.PolicyStatement(
+            actions=[
+                "batch:DescribeJobDefinitions",
+                "batch:DescribeJobQueues",
+                "batch:DescribeComputeEnvironments",
+            ],
+            resources=[
+                f"arn:aws:batch:{self.region}:{self.account}:job-definition/workbench-*",
+                f"arn:aws:batch:{self.region}:{self.account}:job-queue/workbench-*",
+                f"arn:aws:batch:{self.region}:{self.account}:compute-environment/workbench-*",
+                f"arn:aws:batch:{self.region}:{self.account}:job/*",  # Job IDs are random UUIDs
+            ],
+        )
+
+    def batch_jobs_full(self) -> iam.PolicyStatement:
+        """Full access to specific Batch resources."""
+        read_statement = self.batch_jobs_read()
+        return iam.PolicyStatement(
+            actions=read_statement.actions
+            + [
+                "batch:RegisterJobDefinition",
+                "batch:DeregisterJobDefinition",
+                "batch:SubmitJob",
+                "batch:TerminateJob",
+                "batch:CancelJob",
+            ],
+            resources=read_statement.resources,
+        )
+
+    def batch_pass_role(self) -> iam.PolicyStatement:
+        """Allows us to specify the Workbench-Batch role when creating a Batch Job"""
+        return iam.PolicyStatement(
+            actions=["iam:PassRole"],
+            resources=[f"arn:aws:iam::{self.account}:role/{self.batch_role_name}"],
+            conditions={"StringEquals": {"iam:PassedToService": "ecs-tasks.amazonaws.com"}},
+        )
+
+    #####################
+    #   Batch Compute   #
+    #####################
+    def create_batch_compute_environment(self) -> batch.FargateComputeEnvironment:
+        """Create the Batch compute environment - super simple with Fargate."""
+        return batch.FargateComputeEnvironment(
+            self,
+            "WorkbenchBatchComputeEnvironment",
+            compute_environment_name="workbench-compute-env",
+            vpc=ec2.Vpc.from_lookup(self, "DefaultVpc", is_default=True),
+        )
+
+    def create_batch_job_queue(self) -> batch.JobQueue:
+        """Create the Batch job queue."""
+        return batch.JobQueue(
+            self,
+            "WorkbenchBatchJobQueue",
+            job_queue_name="workbench-job-queue",
+            compute_environments=[
+                batch.OrderedComputeEnvironment(compute_environment=self.batch_compute_environment, order=1)
+            ],
+        )
+
+    #####################
+    #  DataFrame Store  #
+    #####################
+    def dataframe_store_read(self) -> iam.PolicyStatement:
+        """Create a policy statement for reading from the DataFrame Store.
+
+        Returns:
+            iam.PolicyStatement: The policy statement for reading from the DataFrame Store.
+        """
+
+        # Just return the S3 read policy for the DataFrame Store
+        return self.s3_read()
+
+    def dataframe_store_full(self) -> iam.PolicyStatement:
+        """Create a policy statement for full access to the DataFrame Store.
+
+        Returns:
+            iam.PolicyStatement: The policy statement for full access to the DataFrame Store.
+        """
+
+        # Just return the S3 full policy for the DataFrame Store
+        return self.s3_full()
+
+    #####################
+    #  Inference Store  #
+    #####################
+    def inference_store_read(self) -> iam.PolicyStatement:
+        """Create a policy statement for reading from the Parameter Store.
+
+        Returns:
+            iam.PolicyStatement: The policy statement for reading from the Parameter Store.
+        """
+        return iam.PolicyStatement(
+            actions=[
+                "glue:GetDatabase",
+                "glue:GetTable",
+                "glue:GetTables",
+                "glue:GetPartition",
+                "glue:GetPartitions",
+            ],
+            resources=self._inference_database_arns(),
+        )
+
+    def inference_store_full(self) -> iam.PolicyStatement:
+        """Create a policy statement for full access to the Inference Store.
+
+        Returns:
+            iam.PolicyStatement: The policy statement for full access to the Inference Store.
+        """
+        read_statement = self.inference_store_read()
+        return iam.PolicyStatement(
+            actions=read_statement.actions
+            + [
+                "glue:CreateTable",
+                "glue:UpdateTable",
+                "glue:DeleteTable",
+            ],
+            resources=self._inference_database_arns(),
+        )
+
+    ####################
+    #  VPC/Networking  #
+    ####################
+    @staticmethod
+    def vpc_discovery() -> iam.PolicyStatement:
+        """Create a policy statement for VPC resource discovery.
+
+        Returns:
+            iam.PolicyStatement: The policy statement for VPC subnet and security group discovery operations.
+        """
+        return iam.PolicyStatement(
+            actions=[
+                "ec2:DescribeSubnets",
+                "ec2:DescribeSecurityGroups",
+                "ec2:DescribeVpcEndpoints",
+                "ec2:DescribeRouteTables",
+            ],
+            resources=[
+                "*",  # EC2 describe operations require wildcard resources
+            ],
+        )
+
+    def vpc_network_interface_management(self) -> iam.PolicyStatement:
+        """Create a policy statement for VPC network interface management.
+        Returns:
+            iam.PolicyStatement: The policy statement for ENI creation and discovery in VPC.
+        """
+        return iam.PolicyStatement(
+            actions=[
+                "ec2:CreateNetworkInterface",
+                "ec2:DescribeNetworkInterfaces",
+                "ec2:CreateTags",
+            ],
+            resources=[
+                f"arn:aws:ec2:{self.region}:{self.account}:network-interface/*",
+                f"arn:aws:ec2:{self.region}:{self.account}:subnet/*",
+                f"arn:aws:ec2:{self.region}:{self.account}:security-group/*",
+            ],
+        )
+
     ####################
     #      Athena      #
     ####################
@@ -945,6 +1181,86 @@ class WorkbenchCoreStack(Stack):
             managed_policy_name="WorkbenchPipelinePolicy",
         )
 
+    def workbench_dataframe_store_read_policy(self) -> iam.ManagedPolicy:
+        """Create a managed policy for the Workbench DataFrame Store (READ-ONLY)"""
+        policy_statements = [
+            self.dataframe_store_read(),
+        ]
+
+        return iam.ManagedPolicy(
+            self,
+            id="WorkbenchDFStoreReadPolicy",
+            statements=policy_statements,
+            managed_policy_name="WorkbenchDFStoreReadPolicy",
+        )
+
+    def workbench_dataframe_store_full_policy(self) -> iam.ManagedPolicy:
+        """Create a managed policy for the Workbench DataFrame Store (FULL)"""
+        policy_statements = [
+            self.dataframe_store_full(),
+        ]
+
+        return iam.ManagedPolicy(
+            self,
+            id="WorkbenchDFStoreFullPolicy",
+            statements=policy_statements,
+            managed_policy_name="WorkbenchDFStorePolicy",
+        )
+
+    def workbench_parameter_store_read_policy(self) -> iam.ManagedPolicy:
+        """Create a managed policy for the Workbench Parameter Store (READ-ONLY)"""
+        policy_statements = [
+            self.parameter_store_discover(),
+            self.parameter_store_read(),
+        ]
+
+        return iam.ManagedPolicy(
+            self,
+            id="WorkbenchParameterStoreReadPolicy",
+            statements=policy_statements,
+            managed_policy_name="WorkbenchParameterStoreReadPolicy",
+        )
+
+    def workbench_parameter_store_full_policy(self) -> iam.ManagedPolicy:
+        """Create a managed policy for the Workbench Parameter Store (FULL)"""
+        policy_statements = [
+            self.parameter_store_discover(),
+            self.parameter_store_full(),
+        ]
+
+        return iam.ManagedPolicy(
+            self,
+            id="WorkbenchParameterStoreFullPolicy",
+            statements=policy_statements,
+            managed_policy_name="WorkbenchParameterStorePolicy",
+        )
+
+    def workbench_inference_store_read_policy(self) -> iam.ManagedPolicy:
+        """Create a managed policy for the Workbench Inference Store (READ-ONLY)"""
+        policy_statements = [
+            self.inference_store_read(),
+        ]
+
+        return iam.ManagedPolicy(
+            self,
+            id="WorkbenchInferenceStoreReadPolicy",
+            statements=policy_statements,
+            managed_policy_name="WorkbenchInferenceStoreReadPolicy",
+        )
+
+    def workbench_inference_store_full_policy(self) -> iam.ManagedPolicy:
+        """Create a managed policy for the Workbench Inference Store (FULL)"""
+        policy_statements = [
+            self.inference_store_full(),
+        ]
+
+        return iam.ManagedPolicy(
+            self,
+            id="WorkbenchInferenceStoreFullPolicy",
+            statements=policy_statements,
+            managed_policy_name="WorkbenchInferenceStorePolicy",
+        )
+
     def create_execution_role(self) -> iam.Role:
         """Create the Workbench Execution Role for API-related tasks"""
         # Define the base assumed by principals with service principals
@@ -966,9 +1282,12 @@ class WorkbenchCoreStack(Stack):
         )
 
         # Create and attach the Workbench managed policies to the role
-        api_execution_role.add_to_policy(self.glue_pass_role())
         api_execution_role.add_to_policy(self.glue_jobs_discover())
         api_execution_role.add_to_policy(self.glue_jobs_full())
+        api_execution_role.add_to_policy(self.glue_pass_role())
+        api_execution_role.add_to_policy(self.batch_jobs_discover())
+        api_execution_role.add_to_policy(self.batch_jobs_full())
+        api_execution_role.add_to_policy(self.batch_pass_role())
         api_execution_role.add_to_policy(self.parameter_store_discover())
         api_execution_role.add_to_policy(self.parameter_store_full())
         api_execution_role.add_to_policy(self.cloudwatch_monitor())
@@ -1038,6 +1357,9 @@ class WorkbenchCoreStack(Stack):
 
         # Add a subset of policies for the Glue Role
         glue_role.add_to_policy(self.glue_job_logs())
+        glue_role.add_to_policy(self.glue_connections())
+        glue_role.add_to_policy(self.vpc_discovery())
+        glue_role.add_to_policy(self.vpc_network_interface_management())
         glue_role.add_to_policy(self.parameter_store_full())
         glue_role.add_managed_policy(self.datasource_policy)
         glue_role.add_managed_policy(self.featureset_policy)
@@ -1046,6 +1368,28 @@ class WorkbenchCoreStack(Stack):
         glue_role.add_managed_policy(self.pipeline_policy)
         return glue_role
 
+    def create_batch_role(self) -> iam.Role:
+        """Create the Workbench Batch Role."""
+        batch_assumed_by = iam.ServicePrincipal("ecs-tasks.amazonaws.com")
+        batch_role = iam.Role(
+            self,
+            id=self.batch_role_name,
+            assumed_by=batch_assumed_by,
+            role_name=self.batch_role_name,
+        )
+
+        # Add policies for the Batch Role
+        batch_role.add_to_policy(self.batch_job_logs())
+        # batch_role.add_to_policy(self.ecr_policy_statement())  # Not sure we need this
+        batch_role.add_to_policy(self.parameter_store_full())
+        batch_role.add_to_policy(self.dataframe_store_full())
+        batch_role.add_managed_policy(self.datasource_policy)
+        batch_role.add_managed_policy(self.featureset_policy)
+        batch_role.add_managed_policy(self.model_policy)
+        batch_role.add_managed_policy(self.endpoint_policy)
+        batch_role.add_managed_policy(self.pipeline_policy)
+        return batch_role
+
     def _create_sso_principals(self, base_principals: iam.CompositePrincipal = None) -> iam.CompositePrincipal:
         """
         Create principals with SSO trust relationship configuration.

{workbench-0.8.165 → workbench-0.8.167}/aws_setup/workbench_dashboard_full/app.py

@@ -12,7 +12,7 @@ print(f"Account: {aws_account}")
 print(f"Region: {aws_region}")
 
 # When you want a different docker image change this line
-dashboard_image = "public.ecr.aws/m6i5k1r2/workbench_dashboard:v0_8_159_amd64"
+dashboard_image = "public.ecr.aws/m6i5k1r2/workbench_dashboard:v0_8_165_amd64"
 
 # Workbench Configuration
 try:

{workbench-0.8.165 → workbench-0.8.167}/aws_setup/workbench_dashboard_lite/app.py

@@ -13,7 +13,7 @@ print(f"Account: {aws_account}")
 print(f"Region: {aws_region}")
 
 # When you want a different docker image change this line
-dashboard_image = "public.ecr.aws/m6i5k1r2/workbench_dashboard:v0_8_159_amd64"
+dashboard_image = "public.ecr.aws/m6i5k1r2/workbench_dashboard:v0_8_165_amd64"
 
 # Workbench Configuration
 try:

workbench-0.8.167/model_docker_images/ml_pipelines/Dockerfile

@@ -0,0 +1,28 @@
+# Multi-stage build for dependency resolution
+FROM python:3.12-slim AS builder
+
+# Install build dependencies
+RUN apt-get update && \
+    apt-get install -y --no-install-recommends \
+        build-essential \
+        gcc
+
+# Copy and install requirements file
+COPY requirements.txt /tmp/
+RUN pip install --no-cache-dir -r /tmp/requirements.txt
+
+# Final runtime image
+FROM python:3.12-slim
+
+# Copy installed packages from builder
+COPY --from=builder /usr/local/lib/python3.12/site-packages /usr/local/lib/python3.12/site-packages
+COPY --from=builder /usr/local/bin /usr/local/bin
+
+# Install workbench only
+RUN pip install --no-cache-dir workbench==0.8.166
+
+# Add the script runner
+COPY ml_pipeline_runner.py /app/ml_pipeline_runner.py
+WORKDIR /app
+
+ENTRYPOINT ["python", "/app/ml_pipeline_runner.py"]