idp-deploy.yaml

AWSTemplateFormatVersion: "2010-09-09"

Description: |
  (SO9052) - This solution creates an Amazon SageMaker Studio domain along with the necessary resources required for the Intelligent Document Processing Workshop.

Parameters:
  UserProfileName:
    Type: String
    Description: The user profile name for the IDP workshop
    Default: 'SageMakerUser'
  DomainName:
    Type: String
    Description: The domain name of the Sagemaker studio instance
    Default: 'IDPSagemakerDomain'
  
Mappings: 
  RegionMap: 
    us-east-1: 
      datascience: "arn:aws:sagemaker:us-east-1:081325390199:image/datascience-1.0"
    us-east-2:
      datascience: "arn:aws:sagemaker:us-east-2:429704687514:image/datascience-1.0"   
    us-west-1: 
      datascience: "arn:aws:sagemaker:us-west-1:742091327244:image/datascience-1.0"
    us-west-2: 
      datascience: "arn:aws:sagemaker:us-west-2:236514542706:image/datascience-1.0"
    af-south-1:
      datascience: "arn:aws:sagemaker:af-south-1:559312083959:image/datascience-1.0"   
    ap-east-1:
      datascience: "arn:aws:sagemaker:ap-east-1:493642496378:image/datascience-1.0"
    ap-south-1:
      datascience: "arn:aws:sagemaker:ap-south-1:394103062818:image/datascience-1.0" 
    ap-northeast-2:
      datascience: "arn:aws:sagemaker:ap-northeast-2:806072073708:image/datascience-1.0"
    ap-southeast-1:
      datascience: "arn:aws:sagemaker:ap-southeast-1:492261229750:image/datascience-1.0"     
    ap-southeast-2:
      datascience: "arn:aws:sagemaker:ap-southeast-2:452832661640:image/datascience-1.0"
    ap-northeast-1: 
      datascience: "arn:aws:sagemaker:ap-northeast-1:102112518831:image/datascience-1.0"
    ca-central-1:
      datascience: "arn:aws:sagemaker:ca-central-1:310906938811:image/datascience-1.0"
    eu-central-1: 
      datascience: "arn:aws:sagemaker:eu-central-1:936697816551:image/datascience-1.0"
    eu-west-1:
      datascience: "arn:aws:sagemaker:eu-west-1:470317259841:image/datascience-1.0"
    eu-west-2:
      datascience: "arn:aws:sagemaker:eu-west-2:712779665605:image/datascience-1.0"
    eu-west-3:
      datascience: "arn:aws:sagemaker:eu-west-3:615547856133:image/datascience-1.0"
    eu-north-1:
      datascience: "arn:aws:sagemaker:eu-north-1:243637512696:image/datascience-1.0"
    eu-south-1:
      datascience: "arn:aws:sagemaker:eu-south-1:488287956546:image/sagemaker-data-wrangler-1.0"
    sa-east-1:
      datascience: "arn:aws:sagemaker:sa-east-1:782484402741:image/datascience-1.0"

Resources:
  LambdaExecutionRole:
    Type: "AWS::IAM::Role"
    Properties:
      AssumeRolePolicyDocument:
        Version: 2012-10-17
        Statement:
          - Effect: Allow
            Principal:
              Service:
                - lambda.amazonaws.com
            Action:
              - "sts:AssumeRole"
      Path: /
      ManagedPolicyArns:
        - 'arn:aws:iam::aws:policy/AmazonEC2ReadOnlyAccess'          
        - arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole

  SageMakerExecutionRole:
    Type: AWS::IAM::Role
    Properties:      
      Description: 'Test role for sagemaker'     
      Policies: 
        - PolicyName: s3-access
          PolicyDocument:
            Version: 2012-10-17
            Statement:
              - 
                Effect: Allow
                Action:
                  - s3:GetObject
                  - s3:PutObject
                  - s3:DeleteObject
                  - s3:ListBucket
                Resource: arn:aws:s3:::*
        - PolicyName: comprehend-passrole
          PolicyDocument:
            Version: 2012-10-17
            Statement:
              -
                Effect: Allow
                Action:
                  - iam:PassRole
                Resource: arn:aws:iam::*:role/*
                Condition:
                  StringLikeIfExists:
                    'iam:PassedToService': "comprehend.amazonaws.com"        
        - PolicyName: textract-comprehend-sl-access
          PolicyDocument:
            Version: 2012-10-17
            Statement:
              - 
                Effect: Allow
                Action:
                  - textract:GetDocumentTextDetection
                  - textract:GetDocumentAnalysis
                  - textract:AnalyzeDocument
                  - textract:AnalyzeID
                  - textract:AnalyzeExpense
                  - textract:DetectDocumentText
                  - textract:StartDocumentAnalysis
                  - textract:StartDocumentTextDetection                  
                  - comprehend:DetectEntities
                  - comprehend:DetectPiiEntities
                  - comprehend:ContainsPiiEntities
                  - comprehend:DescribePiiEntitiesDetectionJob
                  - comprehend:ListPiiEntitiesDetectionJobs
                  - comprehend:StartPiiEntitiesDetectionJob
                  - comprehend:StopPiiEntitiesDetectionJob
                  - comprehend:StartEntitiesDetectionJob
                  - comprehend:ClassifyDocument
                  - comprehend:DescribeDocumentClassificationJob
                  - comprehend:DescribeDocumentClassifier
                  - comprehend:CreateDocumentClassifier
                  - comprehend:CreateEntityRecognizer
                  - comprehend:DescribeEntityRecognizer
                  - comprehend:CreateEndpoint
                  - comprehend:DescribeEndpoint
                  - comprehend:DeleteEndpoint
                  - comprehend:DeleteDocumentClassifier
                  - comprehend:DeleteEntityRecognizer
                  - comprehend:StopTrainingDocumentClassifier
                  - comprehend:StopTrainingEntityRecognizer
                  - comprehend:ListEndpoints 
                  - comprehend:ListEntityRecognizers 
                  - comprehend:ListEntityRecognizerSummaries
                  - comprehend:ListDocumentClassifiers 
                  - comprehend:ListDocumentClassifierSummaries
                  - comprehend:ImportModel
                  - comprehendmedical:DetectEntitiesV2
                  - comprehendmedical:DetectPHI
                  - comprehendmedical:InferICD10CM
                  - comprehendmedical:InferRxNorm
                  - comprehendmedical:InferSNOMEDCT
                  - comprehendmedical:StartICD10CMInferenceJob
                  - comprehendmedical:StartRxNormInferenceJob
                  - comprehendmedical:StartSNOMEDCTInferenceJob
                  - comprehendmedical:StartPHIDetectionJob
                Resource: '*'
      AssumeRolePolicyDocument: 
        Version: 2012-10-17
        Statement:
          - 
            Effect: Allow
            Principal: 
              Service: 
                - sagemaker.amazonaws.com                
                - comprehend.amazonaws.com
            Action: 
              - sts:AssumeRole
      ManagedPolicyArns:
        - arn:aws:iam::aws:policy/AmazonSageMakerFullAccess
        - arn:aws:iam::aws:policy/IAMReadOnlyAccess
        - arn:aws:iam::aws:policy/AmazonAugmentedAIIntegratedAPIAccess

  
  # Adding a wait time after SageMakerExecutionRole creation
  DomainDeploymentDelay:
    Type: 'Custom::Delay'
    DependsOn: SageMakerExecutionRole
    Properties:
      ServiceToken: !GetAtt DelayLambda.Arn
      TimeToWait: 180

  DelayLambda:
    Type: 'AWS::Lambda::Function'
    Properties:
      Handler: "index.handler"
      Timeout: 660
      Role: !GetAtt LambdaExecutionRole.Arn
      Runtime: python3.7
      Code:
        ZipFile: |
          import json
          import cfnresponse
          import time
          def handler(event, context):
            time_to_wait = int(event['ResourceProperties']['TimeToWait'])
            print(f'Waiting for {time_to_wait} seconds')
            time.sleep(time_to_wait)
            print(f'Waiting finished')
            cfnresponse.send(event, context, cfnresponse.SUCCESS, {},'')

  VPC:
    Type: AWS::EC2::VPC
    Properties:
      CidrBlock: 10.0.0.0/16
  PublicSubnet:
    Type: AWS::EC2::Subnet
    Properties:
      CidrBlock: 10.0.0.0/20
      VpcId: !Ref VPC
  PrivateSubnet:
    Type: AWS::EC2::Subnet
    Properties:
      CidrBlock: 10.0.32.0/20
      VpcId: !Ref VPC

  StudioDomain:
    Type: AWS::SageMaker::Domain
    DependsOn: DomainDeploymentDelay
    Properties: 
      AppNetworkAccessType: PublicInternetOnly
      AuthMode: IAM
      DefaultUserSettings: 
          ExecutionRole: !GetAtt SageMakerExecutionRole.Arn
      DomainName: !Ref DomainName 
      SubnetIds: [!Ref PrivateSubnet, !Ref PublicSubnet]
      VpcId: !Ref VPC

  UserProfile:
    Type: AWS::SageMaker::UserProfile
    Properties: 
      DomainId: !GetAtt StudioDomain.DomainId
      UserProfileName: !Ref UserProfileName
      UserSettings:
        ExecutionRole: !GetAtt SageMakerExecutionRole.Arn

  JupyterApp:
    Type: AWS::SageMaker::App
    DependsOn: UserProfile
    Properties: 
      AppName: default
      AppType: JupyterServer
      DomainId: !GetAtt StudioDomain.DomainId
      UserProfileName: !Ref UserProfileName
  
  DataScienceApp:
    Type: AWS::SageMaker::App
    DependsOn: UserProfile
    Properties: 
      AppName: instance-event-engine-datascience-ml-t3-medium
      AppType: KernelGateway
      DomainId: !GetAtt StudioDomain.DomainId
      ResourceSpec: 
        InstanceType:  ml.t3.medium
        SageMakerImageArn: !FindInMap
          - RegionMap
          - !Ref 'AWS::Region'
          - datascience
      UserProfileName: !Ref UserProfileName

### S3 Bucket similar to the one created by the create domain action in the UI
  StudioBucket:
    Type: AWS::S3::Bucket
    Properties:
      BucketName: !Join
        - "-"
        - - "sagemaker-studio"
          - !Select
            - 0
            - !Split
              - "-"
              - !Select
                - 2
                - !Split
                  - "/"
                  - !Ref "AWS::StackId"
      BucketEncryption: 
        ServerSideEncryptionConfiguration: 
        - ServerSideEncryptionByDefault:
            SSEAlgorithm: AES256
      VersioningConfiguration:
        Status: Enabled
  A2IBucket:
    Type: AWS::S3::Bucket
    Properties:
      BucketName: !Join
        - "-"
        - - "idp-a2i"
          - !Select
            - 0
            - !Split
              - "-"
              - !Select
                - 2
                - !Split
                  - "/"
                  - !Ref "AWS::StackId"
      CorsConfiguration:
        CorsRules:
          -
            AllowedOrigins: 
              - "*"
            AllowedMethods:
              - GET
      BucketEncryption: 
        ServerSideEncryptionConfiguration: 
        - ServerSideEncryptionByDefault:
            SSEAlgorithm: AES256
      VersioningConfiguration:
        Status: Enabled