Update for least privilege.

assets/deploy-model-dev.yml

@@ -43,7 +43,6 @@ Resources:
       Tags:
         - Key: Name
           Value: !Sub mlops-${ModelName}-dec-${TrainJobId}
-    DependsOn: Model
 
   Endpoint:
     Type: "AWS::SageMaker::Endpoint"
@@ -53,4 +52,3 @@ Resources:
       Tags:
         - Key: Name
           Value: !Sub mlops-${ModelName}-dev-${TrainJobId}
-    DependsOn: EndpointConfig

assets/deploy-model-prd.yml

@@ -59,7 +59,6 @@ Resources:
       Tags:
         - Key: Name
           Value: !Sub mlops-${ModelName}-prd-${TrainJobId}
-    DependsOn: EndpointConfig
 
   SagemakerDataCapture:
     Type: Custom::EnableDataCapture
@@ -85,6 +84,7 @@ Resources:
       Handler: app.lambda_handler
       Runtime: python3.7
       Role: !GetAtt ApiFunctionRole.Arn
+      KmsKeyArn: !Sub arn:aws:kms:${AWS::Region}:${AWS::AccountId}:key/${KmsKeyId}
       AutoPublishAlias: "live"
       #AutoPublishCodeSha256: !Ref TrainSha256
       DeploymentPreference:
@@ -113,7 +113,7 @@ Resources:
             Path: /api
             Method: post
     DependsOn: SagemakerDataCapture
-    Description: "Api deployment that invokes SagemMaker endpoint"
+    Description: "Api deployment that invokes SageMaker endpoint"
 
   ApiFunctionRole:
     Type: AWS::IAM::Role
@@ -147,6 +147,7 @@ Resources:
       CodeUri: ../api
       Handler: pre_traffic_hook.lambda_handler
       Runtime: python3.7
+      KmsKeyArn: !Sub arn:aws:kms:${AWS::Region}:${AWS::AccountId}:key/${KmsKeyId}
       Policies:
         - Version: "2012-10-17"
           Statement:
@@ -177,6 +178,7 @@ Resources:
       CodeUri: ../api
       Handler: post_traffic_hook.lambda_handler
       Runtime: python3.7
+      KmsKeyArn: !Sub arn:aws:kms:${AWS::Region}:${AWS::AccountId}:key/${KmsKeyId}
       Policies:
         - Version: "2012-10-17"
           Statement:

notebook/mlops.ipynb

@@ -284,6 +284,7 @@
    "outputs": [],
    "source": [
     "import boto3\n",
+    "from botocore.exceptions import ClientError\n",
     "import os\n",
     "import time\n",
     "\n",
@@ -457,8 +458,8 @@
     "        print(\"Endpoint status: {}\".format(response['EndpointStatus']))\n",
     "        if response['EndpointStatus'] == 'InService':\n",
     "            break\n",
-    "    except:\n",
-    "        pass \n",
+    "    except ClientError as e:\n",
+    "        print(e.response[\"Error\"][\"Message\"])\n",
     "    time.sleep(10)"
    ]
   },
@@ -690,7 +691,14 @@
     "print('stack name: {}'.format(stack_name))\n",
     "\n",
     "# Get latest stack events\n",
-    "response = cfn.describe_stack_events(StackName=stack_name)\n",
+    "while True:\n",
+    "    try:\n",
+    "        response = cfn.describe_stack_events(StackName=stack_name)\n",
+    "        break\n",
+    "    except ClientError as e:\n",
+    "        print(e.response[\"Error\"][\"Message\"])\n",
+    "    time.sleep(10)\n",
+    "    \n",
     "get_event_dataframe(response['StackEvents']).head()"
    ]
   },
@@ -735,8 +743,8 @@
     "            and 'DataCaptureConfig' in response \\\n",
     "            and response['DataCaptureConfig']['EnableCapture']:\n",
     "            break\n",
-    "    except:\n",
-    "        pass\n",
+    "    except ClientError as e:\n",
+    "        print(e.response[\"Error\"][\"Message\"])\n",
     "    time.sleep(10)"
    ]
   },
@@ -777,6 +785,7 @@
     "    response = cfn.describe_stacks(StackName=stack_name)\n",
     "    if response['Stacks']:\n",
     "        stack = response['Stacks'][0]\n",
+    "        outputs = None\n",
     "        if 'Outputs' in stack:\n",
     "            outputs = dict([(o['OutputKey'], o['OutputValue']) for o in stack['Outputs']])\n",
     "        return stack['StackStatus'], outputs \n",
@@ -787,8 +796,8 @@
     "        status, outputs = get_stack_status(stack_name)\n",
     "        response = sm.describe_endpoint(EndpointName=prd_endpoint_name)\n",
     "        print(\"Endpoint status: {}\".format(response['EndpointStatus']))\n",
-    "    except:\n",
-    "        pass\n",
+    "    except ClientError as e:\n",
+    "        print(e.response[\"Error\"][\"Message\"])\n",
     "    time.sleep(10)    \n",
     "                \n",
     "print('stack status: {}'.format(status))\n",
@@ -845,8 +854,8 @@
     "        if status.endswith('COMPLETE'):\n",
     "            print('Deployment complete\\n')\n",
     "            break\n",
-    "    except Exception as e:\n",
-    "        pass\n",
+    "    except ClientError as e:\n",
+    "        print(e.response[\"Error\"][\"Message\"])\n",
     "    time.sleep(10)"
    ]
   },
@@ -1033,8 +1042,8 @@
     "while processing_job_arn == None:\n",
     "    try:\n",
     "        response = sm.list_monitoring_executions(MonitoringScheduleName=schedule_name)\n",
-    "    except:\n",
-    "        pass\n",
+    "    except ClientError as e:\n",
+    "        print(e.response[\"Error\"][\"Message\"])\n",
     "    for mon in response['MonitoringExecutionSummaries']:\n",
     "        status = mon['MonitoringExecutionStatus']\n",
     "        now = datetime.now(tzlocal())\n",
@@ -1235,8 +1244,6 @@
    "metadata": {},
    "outputs": [],
    "source": [
-    "from botocore.exceptions import ClientError\n",
-    "\n",
     "while True:\n",
     "    try:\n",
     "        response = synth.get_canary(Name=canary_name)\n",
@@ -1252,8 +1259,7 @@
     "        if e.response[\"Error\"][\"Code\"] == \"ResourceNotFoundException\":\n",
     "            print('No canary found.')\n",
     "            break\n",
-    "    except:\n",
-    "        pass\n",
+    "        print(e.response[\"Error\"][\"Message\"])\n",
     "    time.sleep(10)\n",
     "\n",
     "# Output a html link to the cloudwatch console\n",
@@ -1332,8 +1338,7 @@
     "        if e.response[\"Error\"][\"Code\"] == \"ResourceNotFoundException\":\n",
     "            print('Canary succesfully deleted.')\n",
     "            break\n",
-    "    except:\n",
-    "        pass\n",
+    "        print(e.response[\"Error\"][\"Message\"])\n",
     "    time.sleep(10)"
    ]
   },
@@ -1370,6 +1375,18 @@
    "display_name": "conda_python3",
    "language": "python",
    "name": "conda_python3"
+  },
+  "language_info": {
+   "codemirror_mode": {
+    "name": "ipython",
+    "version": 3
+   },
+   "file_extension": ".py",
+   "mimetype": "text/x-python",
+   "name": "python",
+   "nbconvert_exporter": "python",
+   "pygments_lexer": "ipython3",
+   "version": "3.6.10"
   }
  },
  "nbformat": 4,