feat: Add VPC/subnets/sg config for multi-account project template to sagemaker-templates-service-catalog module

CHANGELOG.md

@@ -11,6 +11,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ### **Added**
 
+- added VPC/subnets/sg config for multi-account project template to `sagemaker-templates-service-catalog` module
 - added `sagemaker-custom-kernel` module
 - added batch inference project template to `sagemaker-templates-service-catalog` module
 - added EFS removal policy to `mlflow-fargate` module

manifests/sagemaker-templates-modules.yaml

@@ -7,4 +7,58 @@ parameters:
       moduleMetadata:
         group: sagemaker-studio
         name: studio
-        key: LeadDataScientistRoleArn
+        key: LeadDataScientistRoleArn
+  - name: dev-account-id
+    valueFrom:
+      envVariable: PRIMARY_ACCOUNT
+  - name: dev-region
+    valueFrom:
+      envVariable: PRIMARY_REGION
+  - name: dev-vpc-id
+    valueFrom:
+      moduleMetadata:
+        group: networking
+        name: networking
+        key: VpcId
+  - name: dev-subnet-ids
+    valueFrom:
+      moduleMetadata:
+        group: networking
+        name: networking
+        key: PrivateSubnetIds
+  - name: pre-prod-account-id
+    valueFrom:
+      envVariable: PRIMARY_ACCOUNT
+  - name: pre-prod-region
+    valueFrom:
+      envVariable: PRIMARY_REGION
+  - name: pre-prod-vpc-id
+    valueFrom:
+      moduleMetadata:
+        group: networking
+        name: networking
+        key: VpcId
+  - name: pre-prod-subnet-ids
+    valueFrom:
+      moduleMetadata:
+        group: networking
+        name: networking
+        key: PrivateSubnetIds
+  - name: prod-account-id
+    valueFrom:
+      envVariable: PRIMARY_ACCOUNT
+  - name: prod-region
+    valueFrom:
+      envVariable: PRIMARY_REGION
+  - name: prod-vpc-id
+    valueFrom:
+      moduleMetadata:
+        group: networking
+        name: networking
+        key: VpcId
+  - name: prod-subnet-ids
+    valueFrom:
+      moduleMetadata:
+        group: networking
+        name: networking
+        key: PrivateSubnetIds

modules/sagemaker/sagemaker-templates-service-catalog/README.md

@@ -32,6 +32,19 @@ This project template contains SageMaker pipeline that performs batch inference.
 ### Optional Inputs:
   - `portfolio-name` - name of the Service Catalog Portfolio
   - `portfolio-owner` - owner of the Service Catalog Portfolio
+  - `dev-vpc-id` - id of VPC in dev environment
+  - `dev-subnet-ids` - list of subnet ids
+  - `dev-security-group-ids` - list of security group ids
+  - `pre-prod-account-id` - pre-prod account id
+  - `pre-prod-region` - pre-prod region
+  - `pre-prod-vpc-id` - id of VPC in pre-prod environment
+  - `pre-prod-subnet-ids` - list of subnet ids
+  - `pre-prod-security-group-ids` - list of security group ids
+  - `prod-account-id` - prod account id
+  - `prod-region` - prod region
+  - `prod-vpc-id` - id of VPC in prod environment
+  - `prod-subnet-ids` - list of subnet ids
+  - `prod-security-group-ids` - list of security group ids
 
 ### Sample manifest declaration
 

modules/sagemaker/sagemaker-templates-service-catalog/app.py

@@ -1,6 +1,7 @@
 # Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
 # SPDX-License-Identifier: Apache-2.0
 
+import json
 import os
 
 import aws_cdk
@@ -16,6 +17,22 @@
 DEFAULT_PORTFOLIO_NAME = "MLOps SageMaker Project Templates"
 DEFAULT_PORTFOLIO_OWNER = "administrator"
 
+DEFAULT_DEV_VPC_ID = ""
+DEFAULT_DEV_SUBNET_IDS = "[]"
+DEFAULT_DEV_SECURITY_GROUP_IDS = "[]"
+
+DEFAULT_PRE_PROD_ACCOUNT_ID = ""
+DEFAULT_PRE_PROD_REGION = ""
+DEFAULT_PRE_PROD_VPC_ID = ""
+DEFAULT_PRE_PROD_SUBNET_IDS = "[]"
+DEFAULT_PRE_PROD_SECURITY_GROUP_IDS = "[]"
+
+DEFAULT_PROD_ACCOUNT_ID = ""
+DEFAULT_PROD_REGION = ""
+DEFAULT_PROD_VPC_ID = ""
+DEFAULT_PROD_SUBNET_IDS = "[]"
+DEFAULT_PROD_SECURITY_GROUP_IDS = "[]"
+
 
 def _param(name: str) -> str:
     return f"SEEDFARMER_PARAMETER_{name}"
@@ -30,16 +47,49 @@ def _param(name: str) -> str:
 portfolio_owner = os.getenv(_param("PORTFOLIO_OWNER"), DEFAULT_PORTFOLIO_OWNER)
 portfolio_access_role_arn = os.getenv(_param("PORTFOLIO_ACCESS_ROLE_ARN"))
 
+dev_vpc_id = os.getenv(_param("DEV_VPC_ID"), DEFAULT_DEV_VPC_ID)
+dev_subnet_ids = json.loads(os.getenv(_param("DEV_SUBNET_IDS"), DEFAULT_DEV_SUBNET_IDS))
+dev_security_group_ids = json.loads(os.getenv(_param("DEV_SECURITY_GROUP_IDS"), DEFAULT_DEV_SECURITY_GROUP_IDS))
+
+pre_prod_account_id = os.getenv(_param("PRE_PROD_ACCOUNT_ID"), DEFAULT_PRE_PROD_ACCOUNT_ID)
+pre_prod_region = os.getenv(_param("PRE_PROD_REGION"), DEFAULT_PRE_PROD_REGION)
+pre_prod_vpc_id = os.getenv(_param("DEV_VPC_ID"), DEFAULT_PRE_PROD_VPC_ID)
+pre_prod_subnet_ids = json.loads(os.getenv(_param("PRE_PROD_SUBNET_IDS"), DEFAULT_PRE_PROD_SUBNET_IDS))
+pre_prod_security_group_ids = json.loads(
+    os.getenv(_param("PRE_PROD_SECURITY_GROUP_IDS"), DEFAULT_PROD_SECURITY_GROUP_IDS)
+)
+
+prod_account_id = os.getenv(_param("PROD_ACCOUNT_ID"), DEFAULT_PROD_ACCOUNT_ID)
+prod_region = os.getenv(_param("PROD_REGION"), DEFAULT_PROD_REGION)
+prod_vpc_id = os.getenv(_param("PROD_VPC_ID"), DEFAULT_PROD_VPC_ID)
+prod_subnet_ids = json.loads(os.getenv(_param("PROD_SUBNET_IDS"), DEFAULT_PROD_SUBNET_IDS))
+prod_security_group_ids = json.loads(os.getenv(_param("PROD_SECURITY_GROUP_IDS"), DEFAULT_PROD_SECURITY_GROUP_IDS))
+
+
 if not portfolio_access_role_arn:
     raise ValueError("Missing input parameter portfolio-access-role-arn")
 
+
 app = aws_cdk.App()
 stack = ServiceCatalogStack(
     app,
     app_prefix,
     portfolio_name=portfolio_name,
     portfolio_owner=portfolio_owner,
     portfolio_access_role_arn=portfolio_access_role_arn,
+    dev_vpc_id=dev_vpc_id,
+    dev_subnet_ids=dev_subnet_ids,
+    dev_security_group_ids=dev_security_group_ids,
+    pre_prod_account_id=pre_prod_account_id,
+    pre_prod_region=pre_prod_region,
+    pre_prod_vpc_id=pre_prod_vpc_id,
+    pre_prod_subnet_ids=pre_prod_subnet_ids,
+    pre_prod_security_group_ids=pre_prod_security_group_ids,
+    prod_account_id=prod_account_id,
+    prod_region=prod_region,
+    prod_vpc_id=prod_vpc_id,
+    prod_subnet_ids=prod_subnet_ids,
+    prod_security_group_ids=prod_security_group_ids,
 )
 
 

modules/sagemaker/sagemaker-templates-service-catalog/stack.py

@@ -3,7 +3,7 @@
 
 import importlib
 import os
-from typing import Any, Optional, Tuple
+from typing import Any, List, Optional, Tuple
 
 import cdk_nag
 from aws_cdk import BundlingOptions, BundlingOutput, DockerImage, Stack, Tags
@@ -21,6 +21,19 @@ def __init__(
         portfolio_name: str,
         portfolio_owner: str,
         portfolio_access_role_arn: str,
+        dev_vpc_id: str,
+        dev_subnet_ids: List[str],
+        dev_security_group_ids: List[str],
+        pre_prod_account_id: str,
+        pre_prod_region: str,
+        pre_prod_vpc_id: str,
+        pre_prod_subnet_ids: List[str],
+        pre_prod_security_group_ids: List[str],
+        prod_account_id: str,
+        prod_region: str,
+        prod_vpc_id: str,
+        prod_subnet_ids: List[str],
+        prod_security_group_ids: List[str],
         **kwargs: Any,
     ) -> None:
         super().__init__(scope, id, **kwargs)
@@ -63,7 +76,6 @@ def __init__(
         for template_name in next(os.walk(templates_dir))[1]:
             if template_name == "__pycache__":
                 continue
-
             build_app_asset, deploy_app_asset = self.upload_assets(
                 portfolio_access_role=portfolio_access_role,
                 template_name=template_name,
@@ -75,6 +87,19 @@ def __init__(
                 f"{template_name}ProductStack",
                 build_app_asset=build_app_asset,
                 deploy_app_asset=deploy_app_asset,
+                dev_vpc_id=dev_vpc_id,
+                dev_subnet_ids=dev_subnet_ids,
+                dev_security_group_ids=dev_security_group_ids,
+                pre_prod_vpc_id=pre_prod_vpc_id,
+                pre_prod_account_id=pre_prod_account_id,
+                pre_prod_region=pre_prod_region,
+                pre_prod_subnet_ids=pre_prod_subnet_ids,
+                pre_prod_security_group_ids=pre_prod_security_group_ids,
+                prod_vpc_id=prod_vpc_id,
+                prod_account_id=prod_account_id,
+                prod_region=prod_region,
+                prod_subnet_ids=prod_subnet_ids,
+                prod_security_group_ids=prod_security_group_ids,
             )
 
             product_name: str = getattr(product_stack, "TEMPLATE_NAME", template_name)

modules/sagemaker/sagemaker-templates-service-catalog/templates/batch_inference/product_stack.py

@@ -23,9 +23,9 @@ def __init__(
         deploy_app_asset: None,
         **kwargs: Any,
     ) -> None:
-        super().__init__(scope, construct_id, **kwargs)
+        super().__init__(scope, construct_id)
 
-        # Define required parmeters
+        # Define required parameters
         sagemaker_project_name = aws_cdk.CfnParameter(
             self,
             "SageMakerProjectName",