feat(stepfunctions-tasks): bedrock createModelCustomizationJob integration #31913

badmintoncryer · 2024-10-26T06:50:11Z

This PR was previously created and passed the community review, but the maintainer review stopped midway, and it was eventually closed. There shouldn’t be any issues with the content, so I am submitting the PR again.

Issue # (if applicable)

Closes #29042

Reason for this change

AWS stepfunctions support optimized integration with AWS bedrock.
Currently, only invokeModel is supported by CDK, but I would like createModelCustomizationJob to be supported in the same manner.

Description of changes

I've added CreatemodelCustomizationJob class.

const taskConfig = {
  baseModel: model,
  clientRequestToken: 'MyToken',
  customizationType: CustomizationType.FINE_TUNING,
  kmsKey,
  customModelName: 'MyCustomModel',
  customModelTags: [{ key: 'key1', value: 'value1' }],
  hyperParameters: {
    batchSize: '10',
  },
  jobName: 'MyCustomizationJob',
  jobTags: [{ key: 'key2', value: 'value2' }],
  outputDataS3Uri: outputBucket.s3UrlForObject(),
  trainingDataS3Uri: trainingBucket.s3UrlForObject(),
  validationDataS3Uri: [validationBucket.s3UrlForObject()],
  vpcConfig: {
    securityGroups: [new ec2.SecurityGroup(stack, 'SecurityGroup', { vpc })],
    subnets: vpc.isolatedSubnets,
  },
};

const task1 = new BedrockCreateModelCustomizationJob(stack, 'CreateModelCustomizationJob1', taskConfig);

const chain = sfn.Chain
  .start(new sfn.Pass(stack, 'Start'))
  .next(task1)
  .next(new sfn.Pass(stack, 'Done'));

new sfn.StateMachine(stack, 'StateMachine', {
  definitionBody: sfn.DefinitionBody.fromChainable(chain),
  timeout: cdk.Duration.seconds(30),
});

Description of how you validated changes

I've added both unit and integ tests.

Checklist

My code adheres to the CONTRIBUTING GUIDE and DESIGN GUIDELINES

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license

…e-model-customization-job.ts Co-authored-by: Luca Pizzini <[email protected]>

packages/aws-cdk-lib/aws-stepfunctions-tasks/lib/bedrock/create-model-customization-job.ts

+  }
+
+  private validatePattern(name: string, pattern: RegExp, value?: string): void {
+    if (value !== undefined && !Token.isUnresolved(value) && !pattern.test(value)) {


badmintoncryer · 2024-11-02T00:32:53Z

@moelasmar It appears that the needs-maintainer-review label was attached, but it was automatically removed.

Additionally, I’m seeing a CodeQL error related to a regular expression, but this expression is directly from the CloudFormation documentation. In this case, I believe it’s acceptable to ignore the error. What are your thoughts?

codecov · 2024-11-27T15:20:04Z

Codecov Report

All modified and coverable lines are covered by tests ✅

Project coverage is 81.38%. Comparing base (b021efe) to head (068c110).
Report is 35 commits behind head on main.

Additional details and impacted files

@@           Coverage Diff           @@
##             main   #31913   +/-   ##
=======================================
  Coverage   81.38%   81.38%           
=======================================
  Files         222      222           
  Lines       13698    13698           
  Branches     2413     2413           
=======================================
  Hits        11148    11148           
  Misses       2271     2271           
  Partials      279      279

Flag	Coverage Δ
suite.unit	`81.38% <ø> (ø)`

Flags with carried forward coverage won't be shown. Click here to find out more.

Components	Coverage Δ
packages/aws-cdk	`80.69% <ø> (ø)`
packages/aws-cdk-lib/core	`82.10% <ø> (ø)`

gracelu0

Hi @badmintoncryer , thank you for working on this! I saw the previously open PR was approved (apologies that it got closed by our automation), I just have a few more comments.

packages/aws-cdk-lib/aws-stepfunctions-tasks/lib/bedrock/create-model-customization-job.ts

gracelu0 · 2024-12-06T23:57:54Z

packages/aws-cdk-lib/aws-stepfunctions-tasks/lib/bedrock/create-model-customization-job.ts

+      this.props.customModelKmsKey.addToResourcePolicy(new iam.PolicyStatement({
+        actions: ['kms:Decrypt', 'kms:GenerateDataKey', 'kms:DescribeKey', 'kms:CreateGrant'],
+        resources: ['*'],
+        principals: [new iam.ArnPrincipal(this._role.roleArn)],
+      }));
+    }
+  }
+


To adhere to the best security practice stated here: https://docs.aws.amazon.com/bedrock/latest/userguide/encryption-custom-job.html#encryption-cm-statements, can we add a kms:ViaService condition to this policy to limit key access to the Amazon Bedrock service? There's an example under the Encrypt a model dropdown in that link

I've updated my code and executed integ test again!

gracelu0 · 2024-12-07T00:09:45Z

packages/aws-cdk-lib/aws-stepfunctions-tasks/lib/bedrock/create-model-customization-job.ts

+          S3Uri: this.props.outputData.bucket.s3UrlForObject(this.props.outputData.prefix),
+        },
+        RoleArn: this._role.roleArn,
+        TrainingDataConfig: {


Just wondering if there's a reason we omit invocationLogsConfig?

https://docs.aws.amazon.com/bedrock/latest/APIReference/API_TrainingDataConfig.html#API_TrainingDataConfig_Contents

When it was created, I remember handling all the parameters, so additional arguments might have been added later. Should I address this as well?

I think it's okay if we don't include it in this PR, but we should ensure the contract allows us to add this in the future (see my other comment about extending the interface)

Pull request has been modified.

badmintoncryer · 2024-12-21T23:26:19Z

@gracelu0 Thank you for your kindness check. I've addressed all of your comments.

aws-cdk-automation · 2025-01-13T11:40:43Z

AWS CodeBuild CI Report

CodeBuild project: AutoBuildv2Project1C6BFA3F-wQm2hXv2jqQv
Commit ID: 068c110
Result: SUCCEEDED
Build Logs (available for 30 days)

Powered by github-codebuild-logs, available on the AWS Serverless Application Repository

gracelu0

Thank you for working on this! I left some comments to improve the interface design for extensibility, and we will need to check the policy updates with security reviewer (so there may be some additional comments to address).

gracelu0 · 2025-01-15T22:51:57Z

packages/aws-cdk-lib/aws-stepfunctions-tasks/README.md

+  bedrock.FoundationModelIdentifier.AMAZON_TITAN_TEXT_G1_EXPRESS_V1,
+);
+
+const task = new tasks.BedrockCreateModelCustomizationJob(this, 'CreateModelCustomizationJob2', {


instead of all the // optional comments can we have a // required comment to point out the required properties?

gracelu0 · 2025-01-15T23:41:46Z

packages/aws-cdk-lib/aws-stepfunctions-tasks/lib/bedrock/create-model-customization-job.ts

+   *
+   * @see https://docs.aws.amazon.com/bedrock/latest/userguide/encryption-custom-job.html
+   *
+   * @default - no encryption


from the linked docs, By default, Amazon Bedrock encrypts custom models with AWS owned keys. - can we specify that as the default here?

gracelu0 · 2025-01-15T23:51:13Z

packages/aws-cdk-lib/aws-stepfunctions-tasks/lib/bedrock/create-model-customization-job.ts

+   *
+   * @default - no prefix
+   */
+  readonly prefix?: string;


what is this prefix field for? since I see for the s3Uri property the pattern is ^s3://[a-z0-9][-.a-z0-9]{1,61}(?:/[-!_*'().a-z0-9A-Z]+(?:/[-!_*'().a-z0-9A-Z]+)*)?/?$ so the prefix is expected to be s3://.

gracelu0 · 2025-01-16T00:05:12Z

packages/aws-cdk-lib/aws-stepfunctions-tasks/lib/bedrock/create-model-customization-job.ts

+   */
+  readonly role?: iam.IRole;
+
+  /**


While I like the simplified BucketConfiguration interface here, I see that TrainingDataConfig already differs from ValidationDataConfig and OutputDataConfig with additional prop invocationLogsConfig.

To avoid making breaking changes in the future in case new sub-properties are added, can we make a base interface BucketConfiguration (maybe called DataBucketConfiguration) and create interfaces extending it for each of outputData, trainingData and validationData ?

gracelu0 · 2025-01-16T00:07:34Z

packages/aws-cdk-lib/aws-stepfunctions-tasks/lib/bedrock/create-model-customization-job.ts

+   *
+   * @see https://docs.aws.amazon.com/bedrock/latest/APIReference/API_Validator.html
+   */
+  readonly validationData: BucketConfiguration[];


It looks like validationDataConfig is not required, so we need to update this and also the validation to allow minimum of 0 validators

gracelu0 · 2025-01-16T19:08:00Z

packages/aws-cdk-lib/aws-stepfunctions-tasks/lib/bedrock/create-model-customization-job.ts

+          S3Uri: this.props.outputData.bucket.s3UrlForObject(this.props.outputData.prefix),
+        },
+        RoleArn: this._role.roleArn,
+        TrainingDataConfig: {


I think it's okay if we don't include it in this PR, but we should ensure the contract allows us to add this in the future (see my other comment about extending the interface)

gracelu0 · 2025-01-16T19:14:09Z

packages/aws-cdk-lib/aws-stepfunctions-tasks/lib/bedrock/create-model-customization-job.ts

+      return this.props.role;
+    }
+    const role = new iam.Role(this, 'BedrockRole', {
+      assumedBy: new iam.ServicePrincipal('bedrock.amazonaws.com'),


From https://docs.aws.amazon.com/bedrock/latest/userguide/model-customization-iam-role.html#model-customization-iam-role-trust it mentions the option to restrict the scope using Condition:

{ "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Principal": { "Service": "bedrock.amazonaws.com" }, "Action": "sts:AssumeRole", "Condition": { "StringEquals": { "aws:SourceAccount": "account-id" }, "ArnEquals": { "aws:SourceArn": "arn:aws:bedrock:us-east-1:account-id:model-customization-job/*" } } } ] }

Can we add this to adhere to PoLP and reduce the permissions scope?

badmintoncryer and others added 30 commits July 4, 2024 22:30

feat: add createModelCustomizationJob class

a976a46

test: add integ test

79dfc84

test: integ test

3798cb7

fix: permission

8a5d70d

test: update integ test

bde1a4f

test: update integ test

3aa76b6

docs: readme

dfa9f8c

fix: jsii problem

8686dcc

test: add unit test

e5d3e3f

test: add unit test

e6d6e37

chore: add default docs

b661fad

fix: iam policy and update comments

b7a8345

chore: remove space

548c706

docs: update readme

0351161

test: update integ test

a414a5a

test: fix unit test

c034b66

docs: fix readme

509203a

fix: readme

83bcf27

Update packages/aws-cdk-lib/aws-stepfunctions-tasks/lib/bedrock/creat…

9568cba

…e-model-customization-job.ts Co-authored-by: Luca Pizzini <[email protected]>

Update packages/aws-cdk-lib/aws-stepfunctions-tasks/lib/bedrock/creat…

a4831da

…e-model-customization-job.ts Co-authored-by: Luca Pizzini <[email protected]>

Update packages/aws-cdk-lib/aws-stepfunctions-tasks/lib/bedrock/creat…

41a0b71

…e-model-customization-job.ts Co-authored-by: Luca Pizzini <[email protected]>

fix: iam policy

d591952

test: fix test

102067e

fix: unit test

fb63238

docs: update readme

41370b6

test: update integ test (temp)

b91224a

fix: remove principal

f921e0e

fix: integ test

caf77fd

chore: remove unnecessary line

5caff6f

chore: udpate integ test

3a65136

aws-cdk-automation added the pr/needs-community-review This PR needs a review from a Trusted Community Member or Core Team Member. label Oct 26, 2024

moelasmar added pr/needs-maintainer-review This PR needs a review from a Core Team Member and removed pr/needs-community-review This PR needs a review from a Trusted Community Member or Core Team Member. labels Oct 26, 2024

aws-cdk-automation added pr/needs-community-review This PR needs a review from a Trusted Community Member or Core Team Member. and removed pr/needs-maintainer-review This PR needs a review from a Core Team Member labels Oct 26, 2024

github-advanced-security bot found potential problems Oct 26, 2024

View reviewed changes

github-actions bot mentioned this pull request Oct 28, 2024

Weekly PR metrics report #31915

Closed

badmintoncryer force-pushed the createModelCustomizationJob branch from 083ec3a to c209f7f Compare October 28, 2024 13:22

badmintoncryer added 2 commits October 28, 2024 22:31

Merge branch 'main' into createModelCustomizationJob

baff6fc

Merge branch 'main' into createModelCustomizationJob

ce714e8

github-actions bot mentioned this pull request Nov 1, 2024

Monthly PR metrics report #31972

Closed

badmintoncryer added 2 commits November 6, 2024 12:49

Merge branch 'main' into createModelCustomizationJob

684c475

Merge branch 'main' into createModelCustomizationJob

8fa1b48

Merge branch 'main' into createModelCustomizationJob

ac37e8d

gracelu0 self-assigned this Dec 6, 2024

gracelu0 previously requested changes Dec 7, 2024

View reviewed changes

aws-cdk-automation removed the pr/needs-community-review This PR needs a review from a Trusted Community Member or Core Team Member. label Dec 7, 2024

update

0a05f2e

badmintoncryer added 2 commits December 18, 2024 22:13

update unit test

7493c0b

update snapshot

87f8370

aws-cdk-automation added the pr/needs-community-review This PR needs a review from a Trusted Community Member or Core Team Member. label Dec 21, 2024

Merge branch 'main' into createModelCustomizationJob

068c110

gracelu0 requested changes Jan 16, 2025

View reviewed changes

gracelu0 added the needs-security-review Related to feature or issues that needs security review label Jan 16, 2025

aws-cdk-automation removed the pr/needs-community-review This PR needs a review from a Trusted Community Member or Core Team Member. label Jan 16, 2025

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

feat(stepfunctions-tasks): bedrock createModelCustomizationJob integration #31913

feat(stepfunctions-tasks): bedrock createModelCustomizationJob integration #31913

badmintoncryer commented Oct 26, 2024

badmintoncryer commented Nov 2, 2024

codecov bot commented Nov 27, 2024 •

edited

Loading

gracelu0 left a comment

gracelu0 Dec 6, 2024

badmintoncryer Dec 21, 2024

gracelu0 Dec 7, 2024

badmintoncryer Dec 18, 2024

gracelu0 Jan 16, 2025

badmintoncryer commented Dec 21, 2024

aws-cdk-automation commented Jan 13, 2025

gracelu0 left a comment

gracelu0 Jan 15, 2025

gracelu0 Jan 15, 2025

gracelu0 Jan 15, 2025

gracelu0 Jan 16, 2025

gracelu0 Jan 16, 2025

gracelu0 Jan 16, 2025

gracelu0 Jan 16, 2025

feat(stepfunctions-tasks): bedrock createModelCustomizationJob integration #31913

Are you sure you want to change the base?

feat(stepfunctions-tasks): bedrock createModelCustomizationJob integration #31913

Conversation

badmintoncryer commented Oct 26, 2024

Issue # (if applicable)

Reason for this change

Description of changes

Description of how you validated changes

Checklist

badmintoncryer commented Nov 2, 2024

codecov bot commented Nov 27, 2024 • edited Loading

Codecov Report

gracelu0 left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

badmintoncryer commented Dec 21, 2024

aws-cdk-automation commented Jan 13, 2025

AWS CodeBuild CI Report

gracelu0 left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

codecov bot commented Nov 27, 2024 •

edited

Loading