move lambda to docker due to sagemaker sdk dependency size

Author: kukushking

modules/sagemaker/sagemaker-model-monitoring/sagemaker_model_monitoring/baselining_construct.py

@@ -1,6 +1,6 @@
 from typing import Any, List
 
-from aws_cdk import BundlingOptions, Duration
+from aws_cdk import Duration
 from aws_cdk import aws_events as events
 from aws_cdk import aws_events_targets as targets
 from aws_cdk import aws_iam as iam
@@ -34,27 +34,17 @@ def __init__(
     ) -> None:
         super().__init__(scope, construct_id, **kwargs)
 
-        # Lambda function
-        baselining_lambda = lambda_.Function(
+        # Lambda function using Docker container image
+        # This approach bypasses the 250MB layer limit by using container images (up to 10GB)
+        baselining_lambda = lambda_.DockerImageFunction(
             self,
             "BaseliningLambda",
-            runtime=lambda_.Runtime.PYTHON_3_13,
-            handler="baselining_handler.lambda_handler",
-            code=lambda_.Code.from_asset(
+            code=lambda_.DockerImageCode.from_image_asset(
                 "sagemaker_model_monitoring/lambda",
-                bundling=BundlingOptions(
-                    image=lambda_.Runtime.PYTHON_3_13.bundling_image,
-                    command=[
-                        "bash",
-                        "-c",
-                        "pip install pydantic==2.10.3 -t /asset-output --no-cache-dir && "
-                        "pip install sagemaker==2.232.2 -t /asset-output --no-deps --no-cache-dir && "
-                        "rm -rf /asset-output/{boto*,urllib3*,certifi*,six*,python_dateutil*,jmespath*,s3transfer*} && "
-                        "find /asset-output \\( -name '*.pyc' -o -name '*.so' \\) -delete && "
-                        "find /asset-output -type d \\( -name '__pycache__' -o -name 'test*' \\) -exec rm -rf {} + && "
-                        "cp -au . /asset-output",
-                    ],
-                ),
+                cmd=["baselining_handler.lambda_handler"],
+                build_args={
+                    "PYTHON_VERSION": "3.13",
+                },
             ),
             timeout=Duration.minutes(15),
             memory_size=2048,
@@ -156,6 +146,16 @@ def __init__(
             ),
         )
 
+        # Cron trigger
+        rule = events.Rule(self, "BaseliningScheduleRule", schedule=events.Schedule.expression(schedule_expression))
+
+        for monitor_type in enabled_monitors:
+            rule.add_target(
+                targets.SfnStateMachine(
+                    state_machine, input=events.RuleTargetInput.from_object({"monitor_type": monitor_type})
+                )
+            )
+
         # Add CDK-nag suppressions
         if baselining_lambda.role:
             NagSuppressions.add_resource_suppressions(
@@ -183,13 +183,3 @@ def __init__(
             ],
             apply_to_children=True,
         )
-
-        # Cron trigger
-        rule = events.Rule(self, "BaseliningScheduleRule", schedule=events.Schedule.expression(schedule_expression))
-
-        for monitor_type in enabled_monitors:
-            rule.add_target(
-                targets.SfnStateMachine(
-                    state_machine, input=events.RuleTargetInput.from_object({"monitor_type": monitor_type})
-                )
-            )

modules/sagemaker/sagemaker-model-monitoring/sagemaker_model_monitoring/lambda/.dockerignore

@@ -0,0 +1,18 @@
+__pycache__
+*.pyc
+*.pyo
+*.pyd
+.Python
+*.so
+*.egg
+*.egg-info
+dist
+build
+.pytest_cache
+.coverage
+htmlcov
+.tox
+.git
+.gitignore
+README.md
+*.md

modules/sagemaker/sagemaker-model-monitoring/sagemaker_model_monitoring/lambda/Dockerfile

@@ -0,0 +1,20 @@
+ARG PYTHON_VERSION=3.13
+FROM public.ecr.aws/lambda/python:${PYTHON_VERSION}
+
+# Install build dependencies for numpy and other packages
+RUN dnf install -y gcc gcc-c++ make && \
+    dnf clean all && \
+    rm -rf /var/cache/dnf
+
+# Upgrade pip to latest version
+RUN pip install --no-cache-dir --upgrade pip
+
+# Copy requirements and install dependencies
+COPY requirements.txt ${LAMBDA_TASK_ROOT}/
+RUN pip install --no-cache-dir -r requirements.txt
+
+# Copy function code
+COPY *.py ${LAMBDA_TASK_ROOT}/
+
+# Set the CMD to your handler
+CMD ["baselining_handler.lambda_handler"]

modules/sagemaker/sagemaker-model-monitoring/sagemaker_model_monitoring/lambda/requirements.txt

@@ -0,0 +1,5 @@
+pydantic==2.10.3
+pydantic-core
+# Use numpy version with pre-built wheels for Python 3.13
+numpy>=1.26.0,<2.0
+sagemaker==2.232.2

modules/sagemaker/sagemaker-model-monitoring/sagemaker_model_monitoring/stack.py

@@ -155,17 +155,6 @@ def __init__(
             ),
         )
 
-        # TODO Reduce the use of wildcards by limiting to the provided KMS key ID & needed bucket prefixes.
-        NagSuppressions.add_resource_suppressions(
-            model_monitor_policy,
-            suppressions=[
-                {
-                    "id": "AwsSolutions-IAM5",
-                    "reason": "The IAM policy needs access to the S3 bucket and associated KMS keys",
-                },
-            ],
-        )
-
         model_monitor_role = iam.Role(
             self,
             "Model Monitor Role",
@@ -176,17 +165,6 @@ def __init__(
             ],
         )
 
-        # TODO Avoid AmazonSageMakerFullAccess by limiting to the needed operations.
-        NagSuppressions.add_resource_suppressions(
-            model_monitor_role,
-            suppressions=[
-                {
-                    "id": "AwsSolutions-IAM4",
-                    "reason": "The IAM policy needs access to many SageMaker and EC2 operations.",
-                },
-            ],
-        )
-
         model_bucket_name = model_bucket_arn.split(":")[-1]
 
         if baseline_training_data_s3_uri and baseline_output_data_s3_uri:
@@ -303,3 +281,25 @@ def __init__(
                 probability_attribute=model_explainability_probability_attribute,
                 schedule_expression=model_explainability_schedule_expression,
             )
+
+        # TODO Avoid AmazonSageMakerFullAccess by limiting to the needed operations.
+        NagSuppressions.add_resource_suppressions(
+            model_monitor_role,
+            suppressions=[
+                {
+                    "id": "AwsSolutions-IAM4",
+                    "reason": "The IAM policy needs access to many SageMaker and EC2 operations.",
+                },
+            ],
+        )
+
+        # TODO Reduce the use of wildcards by limiting to the provided KMS key ID & needed bucket prefixes.
+        NagSuppressions.add_resource_suppressions(
+            model_monitor_policy,
+            suppressions=[
+                {
+                    "id": "AwsSolutions-IAM5",
+                    "reason": "The IAM policy needs access to the S3 bucket and associated KMS keys",
+                },
+            ],
+        )