-
Notifications
You must be signed in to change notification settings - Fork 5
/
cloudformation.yaml
406 lines (374 loc) · 11.6 KB
/
cloudformation.yaml
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
# Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
# SPDX-License-Identifier: MIT-0
---
AWSTemplateFormatVersion: "2010-09-09"
Description: This stack deploys the infrastructure used in the blog post, "Explore image analysis results from Amazon Rekognition using Amazon SageMaker and Amazon DocumentDB".
Parameters:
DocDBUsername:
Type: String
Description: Username for the Amazon DocumentDB cluster
DocDBPassword:
Type: String
Description: Password for the Amazon DocumentDB cluster
NoEcho: true
MinLength: 8
DocDBInstanceType:
Type: String
Description: Instance type for DocumentDB cluster
Default: db.r5.large
AllowedValues:
- db.t3.medium
- db.r5.large
- db.r5.xlarge
- db.r5.2xlarge
- db.r5.4xlarge
- db.r5.12xlarge
- db.r5.24xlarge
SageMakerInstanceType:
Type: String
Description: Instance type for SageMaker
Default: ml.t3.xlarge
AllowedValues:
- ml.c5.xlarge
- ml.m5.xlarge
- ml.t3.2xlarge
- ml.t3.xlarge
S3BucketName:
Type: String
Description: Bucket to store images for analysis
Metadata:
AWS::CloudFormation::Interface:
ParameterGroups:
-
Label:
default: "DocumentDB Configuration"
Parameters:
- DocDBInstanceType
- DocDBUsername
- DocDBPassword
ParameterLabels:
DocDBInstanceType:
default: "Instance type for DocumentDB cluster"
DocDBUsername:
default: "DocumentDB master username"
DocDBPassword:
default: "DocumentDB master password"
Mappings:
SubnetConfig:
VPC:
CIDR: '10.0.0.0/16'
PublicOne:
CIDR: '10.0.0.0/24'
PrivateOne:
CIDR: '10.0.100.0/24'
PrivateTwo:
CIDR: '10.0.101.0/24'
PrivateThree:
CIDR: '10.0.102.0/24'
Resources:
# Networking
VPC:
Type: AWS::EC2::VPC
Properties:
EnableDnsSupport: true
EnableDnsHostnames: true
CidrBlock: !FindInMap ['SubnetConfig', 'VPC', 'CIDR']
Tags:
- Key: Name
Value: !Sub ${AWS::StackName}-VPC
PublicSubnetOne:
Type: AWS::EC2::Subnet
Properties:
AvailabilityZone:
Fn::Select:
- 0
- Fn::GetAZs: {Ref: 'AWS::Region'}
VpcId: !Ref VPC
CidrBlock: !FindInMap ['SubnetConfig', 'PublicOne', 'CIDR']
MapPublicIpOnLaunch: true
Tags:
- Key: Name
Value: !Sub ${AWS::StackName}-PublicOne
PrivateSubnetOne:
Type: AWS::EC2::Subnet
Properties:
AvailabilityZone:
Fn::Select:
- 0
- Fn::GetAZs: {Ref: 'AWS::Region'}
VpcId: !Ref VPC
CidrBlock: !FindInMap ['SubnetConfig', 'PrivateOne', 'CIDR']
Tags:
- Key: Name
Value: !Sub ${AWS::StackName}-PrivateOne
PrivateSubnetTwo:
Type: AWS::EC2::Subnet
Properties:
AvailabilityZone:
Fn::Select:
- 1
- Fn::GetAZs: {Ref: 'AWS::Region'}
VpcId: !Ref VPC
CidrBlock: !FindInMap ['SubnetConfig', 'PrivateTwo', 'CIDR']
Tags:
- Key: Name
Value: !Sub ${AWS::StackName}-PrivateTwo
PrivateSubnetThree:
Type: AWS::EC2::Subnet
Properties:
AvailabilityZone:
Fn::Select:
- 2
- Fn::GetAZs: {Ref: 'AWS::Region'}
VpcId: !Ref VPC
CidrBlock: !FindInMap ['SubnetConfig', 'PrivateThree', 'CIDR']
Tags:
- Key: Name
Value: !Sub ${AWS::StackName}-PrivateThree
InternetGateway:
Type: AWS::EC2::InternetGateway
Properties:
Tags:
- Key: Name
Value: !Sub ${AWS::StackName}-igw
GatewayAttachement:
Type: AWS::EC2::VPCGatewayAttachment
Properties:
VpcId: !Ref VPC
InternetGatewayId: !Ref InternetGateway
PublicRouteTable:
Type: AWS::EC2::RouteTable
Properties:
VpcId: !Ref VPC
Tags:
- Key: Name
Value: !Sub ${AWS::StackName}-PublicRouteTable
PublicRoute:
Type: AWS::EC2::Route
DependsOn: GatewayAttachement
Properties:
RouteTableId: !Ref PublicRouteTable
DestinationCidrBlock: 0.0.0.0/0
GatewayId: !Ref InternetGateway
PublicSubnetOneRouteTableAssociation:
Type: AWS::EC2::SubnetRouteTableAssociation
Properties:
SubnetId: !Ref PublicSubnetOne
RouteTableId: !Ref PublicRouteTable
# DocumentDB
DocumentDBSecurityGroup:
Type: AWS::EC2::SecurityGroup
Properties:
GroupDescription: Amazon DocumentDB Security Group
GroupName: !Sub ${AWS::StackName}-SG-DocumentDB
VpcId: !Ref VPC
SecurityGroupIngress:
- IpProtocol: tcp
CidrIp: 10.0.0.0/16
FromPort: 27017
ToPort: 27017
Tags:
- Key: Name
Value: !Sub ${AWS::StackName}-SG-DocumentDB
DocumentDBSubnetGroup:
Type: AWS::DocDB::DBSubnetGroup
Properties:
DBSubnetGroupDescription: Subnet Group for DocumentDB
DBSubnetGroupName: !Sub ${AWS::StackName}-SG-DocumentDB
SubnetIds:
- !Ref PrivateSubnetOne
- !Ref PrivateSubnetTwo
- !Ref PrivateSubnetThree
Tags:
- Key: Name
Value: !Sub ${AWS::StackName}-SG-DocumentDB
DocumentDBCluster:
Type: AWS::DocDB::DBCluster
Properties:
DBClusterIdentifier: !Sub ${AWS::StackName}-DocumentDB
MasterUsername: !Ref DocDBUsername
MasterUserPassword: !Ref DocDBPassword
DBSubnetGroupName : !Ref DocumentDBSubnetGroup
StorageEncrypted: yes
Tags:
- Key: Name
Value: !Sub ${AWS::StackName}-DocumentDB
VpcSecurityGroupIds:
- !Ref DocumentDBSecurityGroup
DependsOn: VPC
DocumentDBInstanceOne:
Type: AWS::DocDB::DBInstance
Properties:
DBClusterIdentifier: !Ref DocumentDBCluster
DBInstanceClass: !Ref DocDBInstanceType
Tags:
- Key: Name
Value: !Sub ${AWS::StackName}-DocumentDBInstance1
DocumentDBInstanceTwo:
Type: AWS::DocDB::DBInstance
Properties:
DBClusterIdentifier: !Ref DocumentDBCluster
DBInstanceClass: !Ref DocDBInstanceType
Tags:
- Key: Name
Value: !Sub ${AWS::StackName}-DocumentDBInstance2
DocumentDBInstanceThree:
Type: AWS::DocDB::DBInstance
Properties:
DBClusterIdentifier: !Ref DocumentDBCluster
DBInstanceClass: !Ref DocDBInstanceType
Tags:
- Key: Name
Value: !Sub ${AWS::StackName}-DocumentDBInstance3
DocDBSecret:
Type: 'AWS::SecretsManager::Secret'
Properties:
Name: !Sub ${AWS::StackName}-DocDBSecret
Description: This secret has the credentials for the DocumentDB cluster
SecretString:
!Join
- ''
- - '{"username":"'
- !Ref DocDBUsername
- '","password":"'
- !Ref DocDBPassword
- '", "ssl": true}'
SecretDocDBClusterAttachment:
Type: AWS::SecretsManager::SecretTargetAttachment
Properties:
SecretId: !Ref DocDBSecret
TargetId: !Ref DocumentDBCluster
TargetType: AWS::DocDB::DBCluster
# SageMaker
SageMakerRole:
Type: AWS::IAM::Role
Properties:
AssumeRolePolicyDocument:
Version: "2012-10-17"
Statement:
-
Effect: "Allow"
Principal:
Service:
- "sagemaker.amazonaws.com"
Action:
- "sts:AssumeRole"
Description: SageMaker notebook instance role granting read access to Secrets Manager
RoleName: !Sub ${AWS::StackName}-SageMakerRoleName
Tags:
- Key: Name
Value: !Sub ${AWS::StackName}-SageMakerRoleName
S3AccessPolicy:
Type: AWS::IAM::Policy
Properties:
PolicyName: !Sub ${AWS::StackName}-S3AccessPolicy
Roles:
- !Ref SageMakerRole
PolicyDocument:
Version: '2012-10-17'
Statement:
-
Effect: Allow
Action:
- s3:GetBucketLocation
- s3:GetObject
- s3:ListBucket
- s3:ListBucketMultipartUploads
- s3:ListMultipartUploadParts
- s3:AbortMultipartUpload
- s3:CreateBucket
- s3:PutObject
Resource:
- !Sub "arn:aws:s3:::${S3BucketName}"
- !Sub "arn:aws:s3:::${S3BucketName}/*"
RekognitionPolicy:
Type: AWS::IAM::Policy
Properties:
PolicyName: !Sub ${AWS::StackName}-RekognitionPolicy
Roles:
- !Ref SageMakerRole
PolicyDocument:
Version: '2012-10-17'
Statement:
-
Effect: Allow
Action:
- "rekognition:*"
Resource: "*"
DocumentDBSecretPolicy:
Type: AWS::IAM::Policy
Properties:
PolicyName: !Sub ${AWS::StackName}-DocumentDBSecretPolicy
Roles:
- !Ref SageMakerRole
PolicyDocument:
Version: '2012-10-17'
Statement:
-
Effect: Allow
Action:
- secretsmanager:GetSecretValue
Resource: !Ref DocDBSecret
SageMakerNotebookInstance:
Type: AWS::SageMaker::NotebookInstance
Properties:
InstanceType: !Ref SageMakerInstanceType
NotebookInstanceName: !Sub ${AWS::StackName}-SageMakerInstance
RoleArn: !GetAtt SageMakerRole.Arn
DirectInternetAccess: Enabled
LifecycleConfigName: !GetAtt SageMakerNotebookInstanceLifecycleConfig.NotebookInstanceLifecycleConfigName
SecurityGroupIds:
- !Ref DocumentDBSecurityGroup
SubnetId: !Ref PublicSubnetOne
Tags:
- Key: Name
Value: !Sub ${AWS::StackName}-SageMakerInstance
VolumeSizeInGB: 5
DependsOn: DocumentDBCluster
SageMakerNotebookInstanceLifecycleConfig:
Type: "AWS::SageMaker::NotebookInstanceLifecycleConfig"
Properties:
OnStart:
- Content:
Fn::Base64:
!Sub |
#!/bin/bash
sudo -u ec2-user -i <<'EOF'
source /home/ec2-user/anaconda3/bin/activate python3
pip install --upgrade pymongo
pip install --upgrade ipyplot
source /home/ec2-user/anaconda3/bin/deactivate
cd /home/ec2-user/SageMaker
wget https://s3.amazonaws.com/rds-downloads/rds-combined-ca-bundle.pem
# wget https://github.com/aws-samples/documentdb-sagemaker-example/raw/main/rekognition/script.ipynb
mkdir pics
cd pics
wget https://github.com/aws-samples/documentdb-sagemaker-example/raw/main/rekognition/pics.zip
unzip pics.zip
rm pics.zip
EOF
Outputs:
StackName:
Value: !Sub ${AWS::StackName}
VpcId:
Value: !Ref VPC
PrivateSubnetOne:
Value: !Ref PrivateSubnetOne
PrivateSubnetTwo:
Value: !Ref PrivateSubnetTwo
PrivateSubnetThree:
Value: !Ref PrivateSubnetThree
PublicSubnetOne:
Value: !Ref PublicSubnetOne
DocumentDBClusterName:
Value: !Ref DocumentDBCluster
DocumentDBCluster:
Value: !GetAtt DocumentDBCluster.Endpoint
DocDBSecret:
Value: !Ref DocDBSecret
SageMakerRole:
Value: !Ref SageMakerRole
SageMakerNotebookInstance:
Value: !Ref SageMakerNotebookInstance
SageMakerNotebookInstanceLifecycleConfig:
Value: !Ref SageMakerNotebookInstanceLifecycleConfig