workbench 0.8.168__tar.gz → 0.8.169__tar.gz

{workbench-0.8.168 → workbench-0.8.169}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: workbench
-Version: 0.8.168
+Version: 0.8.169
 Summary: Workbench: A Dashboard and Python API for creating and deploying AWS SageMaker Model Pipelines
 Author-email: SuperCowPowers LLC <support@supercowpowers.com>
 License-Expression: MIT

{workbench-0.8.168 → workbench-0.8.169}/aws_setup/workbench_core/app.py

@@ -31,7 +31,12 @@ workbench_bucket = (cm and cm.get_config("WORKBENCH_BUCKET")) or os.getenv("WORK
 if not workbench_bucket:
     print("Error: WORKBENCH_BUCKET is required but not found in config or environment variables.")
     exit(1)
-sso_group = (cm and cm.get_config("WORKBENCH_SSO_GROUP")) or os.getenv("WORKBENCH_SSO_GROUP")
+
+# SSO Groups (Groups that can assume the Workbench roles)
+sso_groups_str = (cm and cm.get_config("WORKBENCH_SSO_GROUPS")) or os.getenv("WORKBENCH_SSO_GROUPS", "")
+sso_groups = [group.strip() for group in sso_groups_str.split(",") if group.strip()] if sso_groups_str else []
+
+# Additional Buckets (Extra S3 buckets to grant access to)
 additional_buckets_str = (cm and cm.get_config("WORKBENCH_ADDITIONAL_BUCKETS")) or os.getenv(
     "WORKBENCH_ADDITIONAL_BUCKETS", ""
 )
@@ -44,7 +49,7 @@ subnet_ids = (cm and cm.get_config("WORKBENCH_SUBNET_IDS")) or os.getenv("WORKBE
 # Log the configuration for transparency
 print("Configuration:")
 print(f"  WORKBENCH_BUCKET: {workbench_bucket}")
-print(f"  WORKBENCH_SSO_GROUP: {sso_group}")
+print(f"  WORKBENCH_SSO_GROUPS: {sso_groups}")
 print(f"  WORKBENCH_ADDITIONAL_BUCKETS: {additional_buckets}")
 print(f"  WORKBENCH_VPC_ID: {existing_vpc_id}")
 print(f"  WORKBENCH_SUBNET_IDS: {subnet_ids}")
@@ -60,7 +65,7 @@ sandbox_stack = WorkbenchCoreStack(
     env=env,
     props=WorkbenchCoreStackProps(
         workbench_bucket=workbench_bucket,
-        sso_group=sso_group,
+        sso_groups=sso_groups,
         additional_buckets=additional_buckets,
         existing_vpc_id=existing_vpc_id,
         subnet_ids=subnet_ids,

{workbench-0.8.168 → workbench-0.8.169}/aws_setup/workbench_core/workbench_core/workbench_core_stack.py

@@ -4,18 +4,22 @@ from aws_cdk import (
     aws_iam as iam,
     aws_logs as logs,
     aws_ec2 as ec2,
+    aws_ecs as ecs,
     aws_batch as batch,
     RemovalPolicy,
+    Duration,
+    Size,
 )
 from constructs import Construct
 from typing import Any, List
 from dataclasses import dataclass, field
+from typing import Dict
 
 
 @dataclass
 class WorkbenchCoreStackProps:
     workbench_bucket: str
-    sso_group: str
+    sso_groups: List[str] = field(default_factory=list)
     additional_buckets: List[str] = field(default_factory=list)
     existing_vpc_id: str = None
     subnet_ids: List[str] = field(default_factory=list)  # Optional subnets ids for the Batch compute environment
@@ -39,7 +43,7 @@ class WorkbenchCoreStack(Stack):
 
         # Grab our properties
         self.workbench_bucket = props.workbench_bucket
-        self.sso_group = props.sso_group
+        self.sso_groups = props.sso_groups
         self.additional_buckets = props.additional_buckets
         self.existing_vpc_id = props.existing_vpc_id
         self.subnet_ids = props.subnet_ids
@@ -97,6 +101,7 @@ class WorkbenchCoreStack(Stack):
         # Batch Compute Environment and Job Queue
         self.batch_compute_environment = self.create_batch_compute_environment()
         self.batch_job_queue = self.create_batch_job_queue()
+        self.batch_job_definitions = self.create_batch_job_definitions()
 
     ####################
     #    S3 Buckets    #
@@ -405,7 +410,7 @@ class WorkbenchCoreStack(Stack):
             compute_environment_name="workbench-compute-env",
             vpc=vpc,
             vpc_subnets=vpc_subnets,
-            replace_compute_environment=True,
+            # replace_compute_environment=True,
         )
 
     def create_batch_job_queue(self) -> batch.JobQueue:
@@ -419,6 +424,40 @@ class WorkbenchCoreStack(Stack):
             ],
         )
 
+    def create_batch_job_definitions(self) -> Dict[str, batch.EcsJobDefinition]:
+        """Create ML pipeline job definitions in small/medium/large tiers."""
+
+        ecr_image_uri = f"507740646243.dkr.ecr.{self.region}.amazonaws.com/aws-ml-images/py312-ml-pipelines:0.1"
+        tiers = {
+            "small": (2, 4096),  # 2 vCPU, 4GB RAM
+            "medium": (4, 8192),  # 4 vCPU, 8GB RAM
+            "large": (8, 16384),  # 8 vCPU, 16GB RAM
+        }
+
+        job_definitions = {}
+        for size, (cpu, memory_mib) in tiers.items():
+            job_definitions[size] = batch.EcsJobDefinition(
+                self,
+                f"JobDef{size.capitalize()}",
+                job_definition_name=f"workbench-ml-pipeline-{size}",
+                container=batch.EcsFargateContainerDefinition(
+                    self,
+                    f"Container{size.capitalize()}",
+                    cpu=cpu,
+                    memory=Size.mebibytes(memory_mib),
+                    image=ecs.ContainerImage.from_registry(ecr_image_uri),
+                    job_role=self.workbench_batch_role,
+                    execution_role=self.workbench_batch_role,
+                    environment={
+                        "WORKBENCH_BUCKET": self.workbench_bucket,
+                        "PYTHONUNBUFFERED": "1",
+                    },
+                ),
+                timeout=Duration.hours(3),
+            )
+
+        return job_definitions
+
     #####################
     #  DataFrame Store  #
     #####################
@@ -1424,26 +1463,36 @@ class WorkbenchCoreStack(Stack):
         """
         assumed_by = base_principals or iam.CompositePrincipal()
 
-        # If sso_group is provided, configure trust relationship for AWS SSO integration
+        # If sso_groups are provided, configure trust relationship for AWS SSO integration
         # AWS SSO creates roles with two different ARN patterns depending on configuration:
-        if self.sso_group:
-
-            # Pattern 1: Direct group-based SSO role (no permission set in path)
-            # Used when SSO groups are mapped directly to roles
-            sso_group_arn_1 = (
-                f"arn:aws:iam::{self.account}:role/aws-reserved/sso.amazonaws.com/AWSReservedSSO_{self.sso_group}_*"
-            )
-
-            # Pattern 2: Permission set-based SSO role (includes permission set ID in path)
-            # Used when SSO groups are assigned via permission sets (more common in enterprise setups)
-            # The middle wildcard (*) represents the permission set identifier
-            sso_group_arn_2 = (
-                f"arn:aws:iam::{self.account}:role/aws-reserved/sso.amazonaws.com/*/AWSReservedSSO_{self.sso_group}_*"
-            )
-
+        if self.sso_groups:
+            # Build lists to hold all ARN patterns for all groups
+            sso_group_arns_pattern_1 = []
+            sso_group_arns_pattern_2 = []
+
+            # Generate ARN patterns for each SSO group
+            for sso_group in self.sso_groups:
+                # Pattern 1: Direct group-based SSO role (no permission set in path)
+                # Used when SSO groups are mapped directly to roles
+                sso_group_arn_1 = (
+                    f"arn:aws:iam::{self.account}:role/aws-reserved/sso.amazonaws.com/AWSReservedSSO_{sso_group}_*"
+                )
+                sso_group_arns_pattern_1.append(sso_group_arn_1)
+
+                # Pattern 2: Permission set-based SSO role (includes permission set ID in path)
+                # Used when SSO groups are assigned via permission sets (more common in enterprise setups)
+                # The middle wildcard (*) represents the permission set identifier
+                sso_group_arn_2 = (
+                    f"arn:aws:iam::{self.account}:role/aws-reserved/sso.amazonaws.com/*/AWSReservedSSO_{sso_group}_*"
+                )
+                sso_group_arns_pattern_2.append(sso_group_arn_2)
+
+            # Combine both patterns into a single list for the condition
             # Both patterns are required for maximum compatibility across different SSO configurations
             # This is particularly important for Lake Formation and enterprise SSO integrations
-            condition = {"ArnLike": {"aws:PrincipalArn": [sso_group_arn_1, sso_group_arn_2]}}
+            all_sso_arns = sso_group_arns_pattern_1 + sso_group_arns_pattern_2
+
+            condition = {"ArnLike": {"aws:PrincipalArn": all_sso_arns}}
             assumed_by.add_principals(iam.AccountPrincipal(self.account).with_conditions(condition))
         else:
             # Fallback: Allow any principal in the account to assume this role

{workbench-0.8.168 → workbench-0.8.169}/docs/aws_setup/core_stack.md

@@ -50,7 +50,7 @@ You'll need to set some environmental vars before deploying the stack.
 
 ```
 export WORKBENCH_BUCKET=name-of-workbench-bucket
-export WORKBENCH_SSO_GROUP=DataScientist (or whatever)
+export WORKBENCH_SSO_GROUPS=DataScientists,DataEngineers (no spaces between commas)
 ```
 
 **Optional ENV Vars**

{workbench-0.8.168 → workbench-0.8.169}/model_docker_images/ml_pipelines/ml_pipeline_runner.py

@@ -51,14 +51,16 @@ def main():
         log.error("ML_PIPELINE_S3_PATH environment variable not set")
         sys.exit(1)
 
-    # Extract script name for local file
+    # Construct filename for local download
     script_name = os.path.basename(ml_pipeline_s3_path)
     local_script_path = f"/tmp/{script_name}"
     try:
         # Download the ML pipeline script from S3
         download_ml_pipeline_from_s3(ml_pipeline_s3_path, local_script_path)
+
         # Execute the ML pipeline
         exit_code = run_ml_pipeline(local_script_path)
+
         # Clean up
         os.remove(local_script_path)
         sys.exit(exit_code)

{workbench-0.8.168 → workbench-0.8.169}/src/workbench/scripts/ml_pipeline_launcher.py

@@ -27,60 +27,56 @@ def get_batch_role_arn() -> str:
     return f"arn:aws:iam::{account_id}:role/Workbench-BatchRole"
 
 
-def ensure_job_definition():
-    """Register or update the Batch job definition for ML pipeline runner."""
-    batch = AWSAccountClamp().boto3_session.client("batch")
-    name = "workbench-ml-pipeline-runner"
-    response = batch.register_job_definition(
-        jobDefinitionName=name,
-        type="container",
-        platformCapabilities=["FARGATE"],
-        containerProperties={
-            "image": get_ecr_image_uri(),
-            "resourceRequirements": [{"type": "VCPU", "value": "2"}, {"type": "MEMORY", "value": "4096"}],
-            "jobRoleArn": get_batch_role_arn(),
-            "executionRoleArn": get_batch_role_arn(),
-            "environment": [
-                {"name": "WORKBENCH_BUCKET", "value": workbench_bucket},
-                {"name": "PYTHONUNBUFFERED", "value": "1"},
-            ],
-            # "networkConfiguration": {"assignPublicIp": "ENABLED"},  # Required for ECR Image Pull (when not in VPC)
-        },
-        timeout={"attemptDurationSeconds": 10800},  # 3 hours
-    )
-    log.info(f"Job definition ready: {name} (revision {response['revision']})")
-    return name
+def _log_cloudwatch_link(job: dict, message_prefix: str = "View logs") -> None:
+    """
+    Helper method to log CloudWatch logs link with clickable URL and full URL display.
+
+    Args:
+        job: Batch job description dictionary
+        message_prefix: Prefix for the log message (default: "View logs")
+    """
+    log_stream = job.get("container", {}).get("logStreamName")
+    logs_url = get_cloudwatch_logs_url(log_group="/aws/batch/job", log_stream=log_stream)
+    if logs_url:
+        clickable_url = f"\033]8;;{logs_url}\033\\{logs_url}\033]8;;\033\\"
+        log.info(f"{message_prefix}: {clickable_url}")
+    else:
+        log.info("Check AWS Batch console for logs")
 
 
-def run_batch_job(script_path: str) -> int:
+def run_batch_job(script_path: str, size: str = "small") -> int:
     """
     Submit and monitor an AWS Batch job for ML pipeline execution.
-    This function:
-    1. Uploads the ML pipeline script to S3
-    2. Submits a Batch job to run the script in a container
-    3. Monitors job status until completion
-    4. Returns the job's exit code
+
+    Uploads script to S3, submits Batch job, monitors until completion or 2 minutes of RUNNING.
 
     Args:
         script_path: Local path to the ML pipeline script
+        size: Job size tier - "small" (default), "medium", or "large"
+          - small: 2 vCPU, 4GB RAM for lightweight processing
+          - medium: 4 vCPU, 8GB RAM for standard ML workloads
+          - large: 8 vCPU, 16GB RAM for heavy training/inference
 
     Returns:
-        Exit code from the batch job (0 for success, non-zero for failure)
+        Exit code (0 for success/disconnected, non-zero for failure)
     """
+    if size not in ["small", "medium", "large"]:
+        raise ValueError(f"Invalid size '{size}'. Must be 'small', 'medium', or 'large'")
+
     batch = AWSAccountClamp().boto3_session.client("batch")
     script_name = Path(script_path).stem
 
-    # Upload script to S3 for the container to download
+    # Upload script to S3
     s3_path = f"s3://{workbench_bucket}/batch-jobs/{Path(script_path).name}"
     log.info(f"Uploading script to {s3_path}")
     upload_content_to_s3(Path(script_path).read_text(), s3_path)
 
-    # Submit the Batch job
+    # Submit job
     job_name = f"workbench_{script_name}_{datetime.now():%Y%m%d_%H%M%S}"
     response = batch.submit_job(
         jobName=job_name,
         jobQueue="workbench-job-queue",
-        jobDefinition=ensure_job_definition(),
+        jobDefinition=f"workbench-ml-pipeline-{size}",
         containerOverrides={
             "environment": [
                 {"name": "ML_PIPELINE_S3_PATH", "value": s3_path},
@@ -89,36 +85,38 @@ def run_batch_job(script_path: str) -> int:
         },
     )
     job_id = response["jobId"]
-    log.info(f"Submitted job: {job_name} ({job_id})")
+    log.info(f"Submitted job: {job_name} ({job_id}) using {size} tier")
 
-    # Monitor job execution
-    last_status = None
+    # Monitor job
+    last_status, running_start = None, None
     while True:
-        # Check job status
         job = batch.describe_jobs(jobs=[job_id])["jobs"][0]
         status = job["status"]
+
         if status != last_status:
             log.info(f"Job status: {status}")
             last_status = status
+            if status == "RUNNING":
+                running_start = time.time()
+
+        # Disconnect after 2 minutes of running
+        if status == "RUNNING" and running_start and (time.time() - running_start >= 120):
+            log.info("✅  ML Pipeline is running successfully!")
+            _log_cloudwatch_link(job, "📊  Monitor logs")
+            return 0
 
-        # Check if job completed
+        # Handle completion
         if status in ["SUCCEEDED", "FAILED"]:
             exit_code = job.get("attempts", [{}])[-1].get("exitCode", 1)
-            if status == "FAILED":
-                log.error(f"Job failed: {job.get('statusReason', 'Unknown reason')}")
-            else:
-                log.info("Job completed successfully")
-
-            # Get CloudWatch logs URL
-            log_stream_name = job.get("container", {}).get("logStreamName")
-            logs_url = get_cloudwatch_logs_url(log_group="/aws/batch/job", log_stream=log_stream_name)
-            if logs_url:
-                # OSC 8 hyperlink format for modern terminals
-                clickable_url = f"\033]8;;{logs_url}\033\\{logs_url}\033]8;;\033\\"
-                log.info(f"View logs: {clickable_url}")
+            msg = (
+                "Job completed successfully"
+                if status == "SUCCEEDED"
+                else f"Job failed: {job.get('statusReason', 'Unknown')}"
+            )
+            log.info(msg) if status == "SUCCEEDED" else log.error(msg)
+            _log_cloudwatch_link(job)
             return exit_code
 
-        # Sleep a bit before next status check
         time.sleep(10)
 
 

{workbench-0.8.168 → workbench-0.8.169}/src/workbench.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: workbench
-Version: 0.8.168
+Version: 0.8.169
 Summary: Workbench: A Dashboard and Python API for creating and deploying AWS SageMaker Model Pipelines
 Author-email: SuperCowPowers LLC <support@supercowpowers.com>
 License-Expression: MIT