⭐ Add SageMaker clusters, feature groups, model packages, model cards, spaces, user profiles

[tas50]

Summary

• Add 10 new SageMaker sub-resources: HyperPod clusters (with instance groups and nodes), feature groups (with feature definitions), model packages, model package groups, model cards, spaces, and user profiles
• Add typed VPC cross-references (vpc()) to model, training job, processing job, and cluster resources
• Add missing fields to notebook instance details (instanceType, ipAddressType, platformIdentifier, volumeSizeInGB, failureReason, iamRole, securityGroups)
• Add missing fields to domain (subnets, defaultExecutionRole, ssoLoginUrl, securityGroupForDomainBoundary, appSecurityGroupManagement)
• Add missing fields to training job (iamRole, algorithmSpecification, hyperParameters, enableNetworkIsolation, enableInterContainerTrafficEncryption, failureReason, billableTimeInSeconds, outputDataConfig, resourceConfig, stoppingCondition)
• Add missing fields to processing job (iamRole, enableNetworkIsolation, enableInterContainerTrafficEncryption, processingResources, environment)
• Add SageMaker-to-SageMaker cross-references: modelPackage→modelPackageGroup, space→domain, userProfile→domain

New resources

Resource	Key fields	Typed refs
aws.sagemaker.cluster	arn, name, status, instanceGroups, orchestrator, nodes	iamRole, vpc
aws.sagemaker.clusterInstanceGroup	instanceGroupName, instanceType, status, currentCount, targetCount	iamRole, lifecycleConfig
aws.sagemaker.clusterNode	instanceId, instanceGroupName, instanceType, status, privateDnsHostname	—
aws.sagemaker.featureGroup	arn, name, status, featureDefinitions, offlineStoreConfig, onlineStoreConfig	iamRole
aws.sagemaker.featureDefinition	featureName, featureType, collectionType	—
aws.sagemaker.modelPackage	arn, name, approvalStatus, inferenceSpecification	kmsKey, modelPackageGroup
aws.sagemaker.modelPackageGroup	arn, name, status, description	—
aws.sagemaker.modelCard	arn, name, modelCardStatus, content, modelCardVersion	kmsKey
aws.sagemaker.space	arn, name, status, displayName, settings, ownerUserProfileName	domain
aws.sagemaker.userProfile	arn, name, status, singleSignOnUserIdentifier	domain

Enhanced existing resources

Resource	New fields
notebookinstancedetails	ipAddressType, platformIdentifier, volumeSizeInGB, failureReason, iamRole, securityGroups
domain	subnets, defaultExecutionRole, ssoLoginUrl, securityGroupForDomainBoundary, appSecurityGroupManagement
trainingJob	vpc, iamRole, algorithmSpecification, hyperParameters, enableNetworkIsolation, enableInterContainerTrafficEncryption, failureReason, billableTimeInSeconds, outputDataConfig, resourceConfig, stoppingCondition
processingJob	vpc, iamRole, enableNetworkIsolation, enableInterContainerTrafficEncryption, processingResources, environment
model	vpc (typed cross-reference replacing raw vpcConfig)
inferenceComponent	failureReason

Test plan

• Build provider: make providers/build/aws && make providers/install/aws
• Verify models with VPC cross-ref: mql run aws -c "aws.sagemaker.models { name vpc }"
• Verify pipelines: mql run aws -c "aws.sagemaker.pipelines { name tags }"
• Verify domains with new fields: mql run aws -c "aws.sagemaker.domains { name subnets defaultExecutionRole }"
• Verify notebook details: mql run aws -c "aws.sagemaker.notebookInstances { name details { securityGroups iamRole platformIdentifier volumeSizeInGB } }"
• Verify feature groups: mql run aws -c "aws.sagemaker.featureGroups { name featureDefinitions { featureName featureType } iamRole offlineStoreConfig }"
• Verify model packages: mql run aws -c "aws.sagemaker.modelPackages { name approvalStatus inferenceSpecification }"
• Verify model package groups: mql run aws -c "aws.sagemaker.modelPackageGroups { name status description }"
• Verify model cards: mql run aws -c "aws.sagemaker.modelCards { name modelCardStatus content kmsKey }"
• Verify spaces with domain ref: mql run aws -c "aws.sagemaker.spaces { name domain displayName settings }"
• Verify user profiles with domain traversal: mql run aws -c "aws.sagemaker.userProfiles { name domain { name subnets } }"
• Verify training jobs with VPC: mql run aws -c "aws.sagemaker.trainingJobs { name vpc iamRole }"
• Verify processing jobs: mql run aws -c "aws.sagemaker.processingJobs { name vpc iamRole }"
• Verify endpoints: mql run aws -c "aws.sagemaker.endpoints { name status }"
• Verify clusters (requires HyperPod-supported region): mql run aws -c "aws.sagemaker.clusters { name status instanceGroups nodes }"

🤖 Generated with Claude Code

[mondoo-code-review]

New SageMaker resources added; user profiles ignore tag filters and cluster node IP is always empty.

[github-actions]

Test Results

6 417 tests  ±0   6 413 ✅ ±0   2m 7s ⏱️ +7s
  458 suites ±0       4 💤 ±0 
   38 files   ±0       0 ❌ ±0 

Results for commit 90562a2. ± Comparison against base commit e64d1d8.

♻️ This comment has been updated with latest results.

[mondoo-code-review]

New SageMaker resources won't surface notebook instance details (ipAddressType, platformIdentifier, volumeSizeInGB, failureReason) and CI spell check will break due to removed dictionary words still in use.

[mondoo-code-review]

SageMaker cluster instance group IDs can collide across clusters in the same region, and spell-check expect.txt still missing required terms.

[mondoo-code-review]

SageMaker feature definitions may silently share cached data across different feature groups due to non-unique IDs

[mondoo-code-review]

Feature definition ID collisions remain unfixed; cluster instance group ID fix looks correct.

Superseded by new review

[mondoo-code-review]

ID collision and access-denied fixes for new SageMaker resources look correct.

[mondoo-code-review]

New SageMaker resource types appear well-implemented with proper pagination and null handling.