feat: Implement manual approval and eventbridge

Author: weklund

modules/sagemaker/sagemaker-templates/README.md

@@ -109,6 +109,8 @@ As an example, if `sagemaker-templates-service-catalog` template configured to u
 - `model-package-group-name` - name of the model package group (required)
 - `model-bucket-name` - S3 bucket name for model artifacts (required)
 - `enable-network-isolation` - enable network isolation for endpoints (default: false)
+- `enable-manual-approval` - require manual approval before Pre-Prod and Prod deployments (default: true)
+- `enable-eventbridge-trigger` - automatically trigger pipeline when model is approved in Model Registry (default: true)
 
 #### Hugging Face Import Models Template:
 - `hf-access-token-secret` - AWS Secret Manager secret containing Hugging Face access token (required)

modules/sagemaker/sagemaker-templates/settings.py

@@ -100,6 +100,8 @@ class ModelDeployProjectSettings(CdkBaseSettings):
     model_package_group_name: str
     model_bucket_name: str
     enable_network_isolation: bool = Field(default=False)
+    enable_manual_approval: bool = Field(default=True)
+    enable_eventbridge_trigger: bool = Field(default=True)
 
 
 class HfImportModelsProjectSettings(CdkBaseSettings):

modules/sagemaker/sagemaker-templates/stack.py

@@ -137,6 +137,8 @@ def __init__(
                 model_package_group_name=model_deploy_project_settings.model_package_group_name,
                 model_bucket_name=model_deploy_project_settings.model_bucket_name,
                 enable_network_isolation=model_deploy_project_settings.enable_network_isolation,
+                enable_manual_approval=model_deploy_project_settings.enable_manual_approval,
+                enable_eventbridge_trigger=model_deploy_project_settings.enable_eventbridge_trigger,
                 dev_vpc_id=dev_vpc_id,
                 dev_subnet_ids=dev_subnet_ids,
                 dev_security_group_ids=dev_security_group_ids,

modules/sagemaker/sagemaker-templates/templates/model_deploy/product_stack.py

@@ -77,25 +77,27 @@ def __init__(
         model_package_group_name: str,
         model_bucket_name: str,
         enable_network_isolation: str,
-        dev_vpc_id: str,
-        dev_subnet_ids: List[str],
-        dev_security_group_ids: List[str],
-        pre_prod_account_id: str,
-        pre_prod_region: str,
-        pre_prod_vpc_id: str,
-        pre_prod_subnet_ids: List[str],
-        pre_prod_security_group_ids: List[str],
-        prod_account_id: str,
-        prod_region: str,
-        prod_vpc_id: str,
-        prod_subnet_ids: List[str],
-        prod_security_group_ids: List[str],
-        sagemaker_domain_id: str,
-        sagemaker_domain_arn: str,
-        repository_type: RepositoryType,
-        access_token_secret_name: Optional[str],
-        aws_codeconnection_arn: Optional[str],
-        repository_owner: Optional[str],
+        enable_manual_approval: bool = True,
+        enable_eventbridge_trigger: bool = True,
+        dev_vpc_id: str = "",
+        dev_subnet_ids: List[str] = [],
+        dev_security_group_ids: List[str] = [],
+        pre_prod_account_id: str = "",
+        pre_prod_region: str = "",
+        pre_prod_vpc_id: str = "",
+        pre_prod_subnet_ids: List[str] = [],
+        pre_prod_security_group_ids: List[str] = [],
+        prod_account_id: str = "",
+        prod_region: str = "",
+        prod_vpc_id: str = "",
+        prod_subnet_ids: List[str] = [],
+        prod_security_group_ids: List[str] = [],
+        sagemaker_domain_id: str = "",
+        sagemaker_domain_arn: str = "",
+        repository_type: RepositoryType = RepositoryType.CODECOMMIT,
+        access_token_secret_name: Optional[str] = None,
+        aws_codeconnection_arn: Optional[str] = None,
+        repository_owner: Optional[str] = None,
         **kwargs: Any,
     ) -> None:
         super().__init__(scope, id)
@@ -146,6 +148,8 @@ def __init__(
             "PROD_SUBNET_IDS": codebuild.BuildEnvironmentVariable(value=json.dumps(prod_subnet_ids)),
             "PROD_SECURITY_GROUP_IDS": codebuild.BuildEnvironmentVariable(value=json.dumps(prod_security_group_ids)),
             "ENABLE_NETWORK_ISOLATION": codebuild.BuildEnvironmentVariable(value=enable_network_isolation),
+            "ENABLE_MANUAL_APPROVAL": codebuild.BuildEnvironmentVariable(value=str(enable_manual_approval).lower()),
+            "ENABLE_EVENTBRIDGE_TRIGGER": codebuild.BuildEnvironmentVariable(value=str(enable_eventbridge_trigger).lower()),
         }
         code_pipeline_deploy_project_name = "CodePipelineDeployProject"
 

modules/sagemaker/sagemaker-templates/templates/model_deploy/seed_code/deploy_app/config/constants.py

@@ -51,3 +51,5 @@
 ECR_REPO_ARN = os.getenv("ECR_REPO_ARN", None)
 
 ENABLE_NETWORK_ISOLATION = os.getenv("ENABLE_NETWORK_ISOLATION", "true").lower() == "true"
+ENABLE_MANUAL_APPROVAL = os.getenv("ENABLE_MANUAL_APPROVAL", "true").lower() == "true"
+ENABLE_EVENTBRIDGE_TRIGGER = os.getenv("ENABLE_EVENTBRIDGE_TRIGGER", "true").lower() == "true"

modules/sagemaker/sagemaker-templates/templates/model_deploy/seed_code/deploy_app/deploy_app/pipeline_stack.py

@@ -4,8 +4,10 @@
 import aws_cdk as cdk
 import config.constants as constants
 from aws_cdk import aws_codecommit as codecommit
+from aws_cdk import aws_events as events
+from aws_cdk import aws_events_targets as targets
 from aws_cdk import aws_iam as iam
-from aws_cdk.pipelines import CodeBuildStep, CodePipeline, CodePipelineSource
+from aws_cdk.pipelines import CodeBuildStep, CodePipeline, CodePipelineSource, ManualApprovalStep
 from constructs import Construct
 
 from .deploy_endpoint_stack import DeployEndpointStack
@@ -36,6 +38,8 @@
     "PROD_SUBNET_IDS": json.dumps(constants.PROD_SUBNET_IDS),
     "PROD_SECURITY_GROUP_IDS": json.dumps(constants.PROD_SECURITY_GROUP_IDS),
     "ENABLE_NETWORK_ISOLATION": str(constants.ENABLE_NETWORK_ISOLATION),
+    "ENABLE_MANUAL_APPROVAL": str(constants.ENABLE_MANUAL_APPROVAL),
+    "ENABLE_EVENTBRIDGE_TRIGGER": str(constants.ENABLE_EVENTBRIDGE_TRIGGER),
 }
 
 
@@ -195,13 +199,39 @@ def __init__(self, scope: Construct, construct_id: str, **kwargs: Any) -> None:
                 self,
                 "preprod",
                 env=cdk.Environment(account=constants.PRE_PROD_ACCOUNT_ID, region=constants.PRE_PROD_REGION),
-            )
+            ),
+            pre=[ManualApprovalStep("ApprovePreProd", comment="Approve deployment to Pre-Production")]
+            if constants.ENABLE_MANUAL_APPROVAL
+            else None,
         )
 
         pipeline.add_stage(
             ProdStage(
                 self,
                 "prod",
                 env=cdk.Environment(account=constants.PROD_ACCOUNT_ID, region=constants.PROD_REGION),
-            )
+            ),
+            pre=[ManualApprovalStep("ApproveProd", comment="Approve deployment to Production")]
+            if constants.ENABLE_MANUAL_APPROVAL
+            else None,
         )
+
+        # Build the pipeline to access the underlying CodePipeline construct
+        pipeline.build_pipeline()
+
+        # Add EventBridge rule to trigger pipeline when model is approved in Model Registry
+        if constants.ENABLE_EVENTBRIDGE_TRIGGER:
+            events.Rule(
+                self,
+                "ModelApprovalEventRule",
+                rule_name=f"{constants.PROJECT_NAME}-model-approval-trigger",
+                event_pattern=events.EventPattern(
+                    source=["aws.sagemaker"],
+                    detail_type=["SageMaker Model Package State Change"],
+                    detail={
+                        "ModelPackageGroupName": [constants.MODEL_PACKAGE_GROUP_NAME],
+                        "ModelApprovalStatus": ["Approved"],
+                    },
+                ),
+                targets=[targets.CodePipeline(pipeline.pipeline)],
+            )

modules/sagemaker/sagemaker-templates/tests/test_settings.py

@@ -0,0 +1,63 @@
+# Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+# SPDX-License-Identifier: Apache-2.0
+
+import pytest
+
+from settings import ModelDeployProjectSettings
+
+
+class TestModelDeployProjectSettings:
+    """Tests for ModelDeployProjectSettings parameter handling."""
+
+    def test_default_values(self) -> None:
+        """Test that enable_manual_approval and enable_eventbridge_trigger default to True."""
+        settings = ModelDeployProjectSettings(
+            model_package_group_name="test-group",
+            model_bucket_name="test-bucket",
+        )
+        assert settings.enable_manual_approval is True
+        assert settings.enable_eventbridge_trigger is True
+        assert settings.enable_network_isolation is False
+
+    def test_explicit_true_values(self) -> None:
+        """Test that explicit True values are accepted."""
+        settings = ModelDeployProjectSettings(
+            model_package_group_name="test-group",
+            model_bucket_name="test-bucket",
+            enable_manual_approval=True,
+            enable_eventbridge_trigger=True,
+        )
+        assert settings.enable_manual_approval is True
+        assert settings.enable_eventbridge_trigger is True
+
+    def test_explicit_false_values(self) -> None:
+        """Test that explicit False values are accepted."""
+        settings = ModelDeployProjectSettings(
+            model_package_group_name="test-group",
+            model_bucket_name="test-bucket",
+            enable_manual_approval=False,
+            enable_eventbridge_trigger=False,
+        )
+        assert settings.enable_manual_approval is False
+        assert settings.enable_eventbridge_trigger is False
+
+    def test_required_parameters(self) -> None:
+        """Test that required parameters raise validation errors when missing."""
+        with pytest.raises(ValueError) as excinfo:
+            ModelDeployProjectSettings()
+
+        assert "validation error" in str(excinfo.value).lower()
+
+    def test_model_package_group_name_required(self) -> None:
+        """Test that model_package_group_name is required."""
+        with pytest.raises(ValueError):
+            ModelDeployProjectSettings(
+                model_bucket_name="test-bucket",
+            )
+
+    def test_model_bucket_name_required(self) -> None:
+        """Test that model_bucket_name is required."""
+        with pytest.raises(ValueError):
+            ModelDeployProjectSettings(
+                model_package_group_name="test-group",
+            )

modules/sagemaker/sagemaker-templates/tests/test_stack.py

@@ -87,6 +87,8 @@ def stack(stack_defaults, project_template_type) -> cdk.Stack:
             model_package_group_name="test-model-package-group",
             model_bucket_name="test-model-bucket",
             enable_network_isolation="false",
+            enable_manual_approval=True,
+            enable_eventbridge_trigger=True,
         )
     elif project_template_type == ProjectTemplateType.HF_IMPORT_MODELS:
         hf_import_models_settings = HfImportModelsProjectSettings(