feat(stepfunctions-tasks): bedrock createModelCustomizationJob integration #31913

badmintoncryer · 2024-10-26T06:50:11Z

This PR was previously created and passed the community review, but the maintainer review stopped midway, and it was eventually closed. There shouldn’t be any issues with the content, so I am submitting the PR again.

Issue # (if applicable)

Closes #29042

Reason for this change

AWS stepfunctions support optimized integration with AWS bedrock.
Currently, only invokeModel is supported by CDK, but I would like createModelCustomizationJob to be supported in the same manner.

Description of changes

I've added CreatemodelCustomizationJob class.

const taskConfig = {
  baseModel: model,
  clientRequestToken: 'MyToken',
  customizationType: CustomizationType.FINE_TUNING,
  kmsKey,
  customModelName: 'MyCustomModel',
  customModelTags: [{ key: 'key1', value: 'value1' }],
  hyperParameters: {
    batchSize: '10',
  },
  jobName: 'MyCustomizationJob',
  jobTags: [{ key: 'key2', value: 'value2' }],
  outputDataS3Uri: outputBucket.s3UrlForObject(),
  trainingDataS3Uri: trainingBucket.s3UrlForObject(),
  validationDataS3Uri: [validationBucket.s3UrlForObject()],
  vpcConfig: {
    securityGroups: [new ec2.SecurityGroup(stack, 'SecurityGroup', { vpc })],
    subnets: vpc.isolatedSubnets,
  },
};

const task1 = new BedrockCreateModelCustomizationJob(stack, 'CreateModelCustomizationJob1', taskConfig);

const chain = sfn.Chain
  .start(new sfn.Pass(stack, 'Start'))
  .next(task1)
  .next(new sfn.Pass(stack, 'Done'));

new sfn.StateMachine(stack, 'StateMachine', {
  definitionBody: sfn.DefinitionBody.fromChainable(chain),
  timeout: cdk.Duration.seconds(30),
});

Description of how you validated changes

I've added both unit and integ tests.

Checklist

My code adheres to the CONTRIBUTING GUIDE and DESIGN GUIDELINES

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license

…e-model-customization-job.ts Co-authored-by: Luca Pizzini <lpizzini7@gmail.com>

badmintoncryer · 2024-12-21T23:26:19Z

@gracelu0 Thank you for your kindness check. I've addressed all of your comments.

gracelu0

Thank you for working on this! I left some comments to improve the interface design for extensibility, and we will need to check the policy updates with security reviewer (so there may be some additional comments to address).

gracelu0 · 2025-01-15T22:51:57Z

packages/aws-cdk-lib/aws-stepfunctions-tasks/README.md

+  bedrock.FoundationModelIdentifier.AMAZON_TITAN_TEXT_G1_EXPRESS_V1,
+);
+
+const task = new tasks.BedrockCreateModelCustomizationJob(this, 'CreateModelCustomizationJob2', {


instead of all the // optional comments can we have a // required comment to point out the required properties?

gracelu0 · 2025-01-15T23:41:46Z

packages/aws-cdk-lib/aws-stepfunctions-tasks/lib/bedrock/create-model-customization-job.ts

+   *
+   * @see https://docs.aws.amazon.com/bedrock/latest/userguide/encryption-custom-job.html
+   *
+   * @default - no encryption


from the linked docs, By default, Amazon Bedrock encrypts custom models with AWS owned keys. - can we specify that as the default here?

gracelu0 · 2025-01-15T23:51:13Z

packages/aws-cdk-lib/aws-stepfunctions-tasks/lib/bedrock/create-model-customization-job.ts

+   *
+   * @default - no prefix
+   */
+  readonly prefix?: string;


what is this prefix field for? since I see for the s3Uri property the pattern is ^s3://[a-z0-9][-.a-z0-9]{1,61}(?:/[-!_*'().a-z0-9A-Z]+(?:/[-!_*'().a-z0-9A-Z]+)*)?/?$ so the prefix is expected to be s3://.

I apologize for the confusing naming. This prefix represents the absolute path from the root within the bucket, and is passed to the s3UrlForObject() method as follows.

OutputDataConfig: { S3Uri: this.props.outputData.bucket.s3UrlForObject(this.props.outputData.path), },

I've changed it from "prefix" to "path" and added some explanations. How does this look?

gracelu0 · 2025-01-16T00:05:12Z

packages/aws-cdk-lib/aws-stepfunctions-tasks/lib/bedrock/create-model-customization-job.ts

+   */
+  readonly role?: iam.IRole;
+
+  /**


While I like the simplified BucketConfiguration interface here, I see that TrainingDataConfig already differs from ValidationDataConfig and OutputDataConfig with additional prop invocationLogsConfig.

To avoid making breaking changes in the future in case new sub-properties are added, can we make a base interface BucketConfiguration (maybe called DataBucketConfiguration) and create interfaces extending it for each of outputData, trainingData and validationData ?

Thank you for your nice suggestion. I defined each interfaces like that.

gracelu0 · 2025-01-16T00:07:34Z

packages/aws-cdk-lib/aws-stepfunctions-tasks/lib/bedrock/create-model-customization-job.ts

+   *
+   * @see https://docs.aws.amazon.com/bedrock/latest/APIReference/API_Validator.html
+   */
+  readonly validationData: BucketConfiguration[];


It looks like validationDataConfig is not required, so we need to update this and also the validation to allow minimum of 0 validators

gracelu0 · 2025-01-16T19:08:00Z

packages/aws-cdk-lib/aws-stepfunctions-tasks/lib/bedrock/create-model-customization-job.ts

+          S3Uri: this.props.outputData.bucket.s3UrlForObject(this.props.outputData.prefix),
+        },
+        RoleArn: this._role.roleArn,
+        TrainingDataConfig: {


I think it's okay if we don't include it in this PR, but we should ensure the contract allows us to add this in the future (see my other comment about extending the interface)

gracelu0 · 2025-01-16T19:14:09Z

packages/aws-cdk-lib/aws-stepfunctions-tasks/lib/bedrock/create-model-customization-job.ts

+      return this.props.role;
+    }
+    const role = new iam.Role(this, 'BedrockRole', {
+      assumedBy: new iam.ServicePrincipal('bedrock.amazonaws.com'),


From https://docs.aws.amazon.com/bedrock/latest/userguide/model-customization-iam-role.html#model-customization-iam-role-trust it mentions the option to restrict the scope using Condition:

{ "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Principal": { "Service": "bedrock.amazonaws.com" }, "Action": "sts:AssumeRole", "Condition": { "StringEquals": { "aws:SourceAccount": "account-id" }, "ArnEquals": { "aws:SourceArn": "arn:aws:bedrock:us-east-1:account-id:model-customization-job/*" } } } ] }

Can we add this to adhere to PoLP and reduce the permissions scope?

I've added Condition section!

const role = new iam.Role(this, 'BedrockRole', { assumedBy: new iam.ServicePrincipal('bedrock.amazonaws.com', { conditions: { StringEquals: { 'aws:SourceAccount': account, }, ArnEquals: { 'aws:SourceArn': Stack.of(this).formatArn({ service: 'bedrock', resource: 'model-customization-job', resourceName: '*', }), }, }, }),

…ionJob

Pull request has been modified.

packages/aws-cdk-lib/aws-stepfunctions-tasks/lib/bedrock/create-model-customization-job.ts

+
+  private validatePattern(name: string, pattern: RegExp, value?: string): void {
+    if (value !== undefined && !Token.isUnresolved(value) && !pattern.test(value)) {
+      throw new ValidationError(`${name} must match the pattern ${pattern.toString()}, got: ${value}.`, this);


…ionJob

aws-cdk-automation

(This review is outdated)

✅ Updated pull request passes all PRLinter validations. Dismissing previous PRLinter review.

badmintoncryer · 2025-02-22T00:30:02Z

packages/aws-cdk-lib/aws-stepfunctions-tasks/lib/bedrock/create-model-customization-job.ts

+
+  /**
+   * The S3 bucket configuration where the validation data is stored.
+   * If you don't provide a validation dataset, specify the evaluation percentage by the `Evaluation percentage` hyperparameter.


This information is described in management console.

badmintoncryer · 2025-02-25T13:13:11Z

@gracelu0 I'm really sorry for my late response. I've addressed all of your comments. Could you please reconfirm again?

aws-cdk-automation · 2025-02-25T13:42:59Z

AWS CodeBuild CI Report

CodeBuild project: AutoBuildv2Project1C6BFA3F-wQm2hXv2jqQv
Commit ID: a979625
Result: SUCCEEDED
Build Logs (available for 30 days)

Powered by github-codebuild-logs, available on the AWS Serverless Application Repository

badmintoncryer and others added 30 commits July 4, 2024 22:30

feat: add createModelCustomizationJob class

a976a46

test: add integ test

79dfc84

test: integ test

3798cb7

fix: permission

8a5d70d

test: update integ test

bde1a4f

test: update integ test

3aa76b6

docs: readme

dfa9f8c

fix: jsii problem

8686dcc

test: add unit test

e5d3e3f

test: add unit test

e6d6e37

chore: add default docs

b661fad

fix: iam policy and update comments

b7a8345

chore: remove space

548c706

docs: update readme

0351161

test: update integ test

a414a5a

test: fix unit test

c034b66

docs: fix readme

509203a

fix: readme

83bcf27

Update packages/aws-cdk-lib/aws-stepfunctions-tasks/lib/bedrock/creat…

9568cba

…e-model-customization-job.ts Co-authored-by: Luca Pizzini <lpizzini7@gmail.com>

Update packages/aws-cdk-lib/aws-stepfunctions-tasks/lib/bedrock/creat…

a4831da

…e-model-customization-job.ts Co-authored-by: Luca Pizzini <lpizzini7@gmail.com>

Update packages/aws-cdk-lib/aws-stepfunctions-tasks/lib/bedrock/creat…

41a0b71

…e-model-customization-job.ts Co-authored-by: Luca Pizzini <lpizzini7@gmail.com>

fix: iam policy

d591952

test: fix test

102067e

fix: unit test

fb63238

docs: update readme

41370b6

test: update integ test (temp)

b91224a

fix: remove principal

f921e0e

fix: integ test

caf77fd

chore: remove unnecessary line

5caff6f

chore: udpate integ test

3a65136

Merge branch 'main' into createModelCustomizationJob

068c110

gracelu0 previously requested changes Jan 16, 2025

View reviewed changes

gracelu0 added the needs-security-review label Jan 16, 2025

aws-cdk-automation removed the pr/needs-community-review label Jan 16, 2025

gracelu0 removed their assignment Jan 30, 2025

badmintoncryer added 4 commits February 4, 2025 23:31

Merge remote-tracking branch 'origin/main' into createModelCustomizat…

f9bbc07

…ionJob

update comments

875bcd9

update

f3baec5

remove unused import

32ef5d5

github-advanced-security bot found potential problems Feb 6, 2025

View reviewed changes

badmintoncryer added 3 commits February 10, 2025 22:12

Merge remote-tracking branch 'origin/main' into createModelCustomizat…

4d2d665

…ionJob

update integ

2ce73e0

update unit test

8cb050e

aaythapa self-assigned this Feb 10, 2025

aaythapa removed their assignment Feb 20, 2025

badmintoncryer added 2 commits February 22, 2025 08:29

use evaluation percentage

566e834

Merge remote-tracking branch 'origin/main' into createModelCustomizat…

d0df792

…ionJob

aws-cdk-automation previously requested changes Feb 21, 2025

View reviewed changes

update integ

4d512fc

badmintoncryer commented Feb 22, 2025

View reviewed changes

badmintoncryer added 3 commits February 22, 2025 09:30

Merge branch 'main' into createModelCustomizationJob

6456cfe

Merge branch 'main' into createModelCustomizationJob

ca9e864

fix readme

cdb577d

aws-cdk-automation added the pr/needs-community-review label Feb 25, 2025

Merge branch 'main' into createModelCustomizationJob

a979625

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

feat(stepfunctions-tasks): bedrock createModelCustomizationJob integration #31913

feat(stepfunctions-tasks): bedrock createModelCustomizationJob integration #31913

badmintoncryer commented Oct 26, 2024

badmintoncryer commented Dec 21, 2024

gracelu0 left a comment

gracelu0 Jan 15, 2025

badmintoncryer Feb 10, 2025

gracelu0 Jan 15, 2025

badmintoncryer Feb 10, 2025

gracelu0 Jan 15, 2025

badmintoncryer Feb 10, 2025

gracelu0 Jan 16, 2025

badmintoncryer Feb 10, 2025

gracelu0 Jan 16, 2025

badmintoncryer Feb 10, 2025

gracelu0 Jan 16, 2025

gracelu0 Jan 16, 2025

badmintoncryer Feb 10, 2025

aws-cdk-automation left a comment •

edited

Loading

badmintoncryer Feb 22, 2025

badmintoncryer commented Feb 25, 2025

aws-cdk-automation commented Feb 25, 2025

feat(stepfunctions-tasks): bedrock createModelCustomizationJob integration #31913

Are you sure you want to change the base?

feat(stepfunctions-tasks): bedrock createModelCustomizationJob integration #31913

Conversation

badmintoncryer commented Oct 26, 2024

Issue # (if applicable)

Reason for this change

Description of changes

Description of how you validated changes

Checklist

badmintoncryer commented Dec 21, 2024

gracelu0 left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

aws-cdk-automation left a comment • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

badmintoncryer commented Feb 25, 2025

aws-cdk-automation commented Feb 25, 2025

AWS CodeBuild CI Report

aws-cdk-automation left a comment •

edited

Loading