feat: trigger a one-time baseline generation upon deployment (#393)

* feat: trigger a one-time baseline generation upon deployment

* chore: update unit tests

Author: xuezhma

CHANGELOG.md

@@ -11,12 +11,15 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ### **Changed**
 
+- `sagemaker-model-monitoring` now triggers a one-time baseline generation upon deployment 
+- update seedfarmer version to 8.0.0 
 - fixed duplicate principal error in `sagemaker-templates` module when dev, pre-prod, and prod account IDs resolve to the same AWS account
 - fixed `sagemaker-templates` Model Deploy seed code incorrectly granting S3 permissions to a ManagedPolicy instead of a Role, which caused deployment failures with CDK 2.174.0+
 - update qs to 6.14.1 via npm override to address security vulnerability
 - pin @cdklabs/generative-ai-cdk-constructs to 0.1.311 to fix build compatibility
 - update starlette to 0.50.0 and fastapi to 0.128.0 to address security vulnerabilities
 
+
 ## v3.1.0
 
 ### **Added**

modules/sagemaker/sagemaker-model-monitoring/README.md

@@ -58,6 +58,7 @@ When you provide training data, the module will:
 3. Generate baseline statistics and constraints files
 4. Store the baseline artifacts in your specified S3 location
 5. Schedule automatic baseline regeneration (default: daily at 2 AM UTC)
+6. Trigger a one-time baseline generation immediately upon deployment
 
 ## Inputs/Outputs
 

modules/sagemaker/sagemaker-model-monitoring/sagemaker_model_monitoring/baselining_construct.py

@@ -1,6 +1,7 @@
+import json
 from typing import Any, List
 
-from aws_cdk import Duration
+from aws_cdk import CustomResource, Duration
 from aws_cdk import aws_events as events
 from aws_cdk import aws_events_targets as targets
 from aws_cdk import aws_iam as iam
@@ -167,6 +168,100 @@ def __init__(
                 )
             )
 
+        # Trigger baseline immediately on deployment (fire-and-forget)
+        trigger_lambda = lambda_.Function(
+            self,
+            "TriggerBaselineLambda",
+            runtime=lambda_.Runtime.PYTHON_3_13,
+            handler="index.handler",
+            code=lambda_.Code.from_inline("""
+import boto3
+import json
+import urllib3
+import logging
+
+logger = logging.getLogger()
+logger.setLevel(logging.INFO)
+
+sfn = boto3.client('stepfunctions')
+http = urllib3.PoolManager()
+
+def send_response(event, context, status, reason=None):
+    response_body = {
+        'Status': status,
+        'Reason': reason or f'See CloudWatch Log Stream: {context.log_stream_name}',
+        'PhysicalResourceId': 'baseline-trigger',
+        'StackId': event['StackId'],
+        'RequestId': event['RequestId'],
+        'LogicalResourceId': event['LogicalResourceId'],
+    }
+
+    json_response = json.dumps(response_body)
+    headers = {'content-type': '', 'content-length': str(len(json_response))}
+
+    try:
+        http.request('PUT', event['ResponseURL'], body=json_response, headers=headers)
+    except Exception as e:
+        logger.error(f"Failed to send response: {e}")
+
+def handler(event, context):
+    try:
+        logger.info(f"Event: {json.dumps(event)}")
+        request_type = event['RequestType']
+
+        if request_type in ['Create', 'Update']:
+            state_machine_arn = event['ResourceProperties']['StateMachineArn']
+            monitor_types = json.loads(event['ResourceProperties']['MonitorTypes'])
+
+            for monitor_type in monitor_types:
+                sfn.start_execution(
+                    stateMachineArn=state_machine_arn,
+                    input=json.dumps({'monitor_type': monitor_type})
+                )
+
+            send_response(event, context, 'SUCCESS', 'Baseline generation triggered')
+        elif request_type == 'Delete':
+            send_response(event, context, 'SUCCESS', 'Nothing to delete')
+        else:
+            send_response(event, context, 'SUCCESS', f'No action for {request_type}')
+
+    except Exception as e:
+        logger.error(f"Error: {e}")
+        send_response(event, context, 'FAILED', str(e))
+"""),
+            timeout=Duration.seconds(30),
+        )
+
+        trigger_lambda.add_to_role_policy(
+            iam.PolicyStatement(
+                actions=["states:StartExecution"],
+                resources=[state_machine.state_machine_arn],
+            )
+        )
+
+        CustomResource(
+            self,
+            "TriggerBaselineResource",
+            service_token=trigger_lambda.function_arn,
+            properties={
+                "StateMachineArn": state_machine.state_machine_arn,
+                "MonitorTypes": json.dumps(enabled_monitors),
+            },
+        )
+
+        # Add CDK-nag suppressions
+        if trigger_lambda.role:
+            NagSuppressions.add_resource_suppressions(
+                trigger_lambda.role,
+                [
+                    {
+                        "id": "AwsSolutions-IAM4",
+                        "reason": "Lambda function uses AWS managed policy for basic execution role",
+                    },
+                ],
+                apply_to_children=True,
+            )
+
         # Add CDK-nag suppressions
         if baselining_lambda.role:
             NagSuppressions.add_resource_suppressions(

modules/sagemaker/sagemaker-model-monitoring/tests/test_stack.py

@@ -102,7 +102,7 @@ def test_baseline_generation_resources(stack_defaults: None) -> None:
     template = Template.from_stack(stack)
 
     # Check for Lambda function
-    template.resource_count_is("AWS::Lambda::Function", 1)
+    template.resource_count_is("AWS::Lambda::Function", 2)
 
     # Check for Step Functions state machine
     template.resource_count_is("AWS::StepFunctions::StateMachine", 1)