Skip to content

Commit aa84161

Browse files
estohlmannestohlmann
committed
Model deployer config parsing issue (#269)
* model deployer config parsing issue
1 parent 9d02cf6 commit aa84161

15 files changed

+64
-51
lines changed

‎ecs_model_deployer/src/lib/app.ts

+2-3
Original file line numberDiff line numberDiff line change
@@ -18,13 +18,12 @@ import { AddPermissionBoundary } from '@cdklabs/cdk-enterprise-iac';
1818
import { App, Aspects } from 'aws-cdk-lib';
1919
import { LisaModelStack, LisaModelStackProps } from './lisa_model_stack';
2020

21-
import { ConfigFile, ConfigSchema } from '../../../lib/schema';
21+
import { PartialConfigSchema } from '../../../lib/schema';
2222

2323

2424
export const app = new App();
2525

26-
const configFile = JSON.parse(process.env['LISA_CONFIG']!) as ConfigFile;
27-
const config = ConfigSchema.parse(configFile);
26+
const config = PartialConfigSchema.parse(JSON.parse(process.env['LISA_CONFIG']!));
2827

2928
const modelConfig = JSON.parse(process.env['LISA_MODEL_CONFIG']!);
3029

‎ecs_model_deployer/src/lib/ecs-model.ts

+11-10
Original file line numberDiff line numberDiff line change
@@ -21,7 +21,7 @@ import { Construct } from 'constructs';
2121

2222
import { ECSCluster } from './ecsCluster';
2323
import { getModelIdentifier } from './utils';
24-
import { BaseProps, Config, Ec2Metadata, EcsClusterConfig, EcsSourceType } from '../../../lib/schema';
24+
import { Ec2Metadata, EcsClusterConfig, EcsSourceType, PartialConfig } from '../../../lib/schema';
2525
import { StringParameter } from 'aws-cdk-lib/aws-ssm';
2626

2727
// This is the amount of memory to buffer (or subtract off) from the total instance memory, if we don't include this,
@@ -40,7 +40,8 @@ type ECSModelProps = {
4040
securityGroup: ISecurityGroup;
4141
vpc: IVpc;
4242
subnetSelection?: SubnetSelection;
43-
} & BaseProps;
43+
config: PartialConfig
44+
};
4445

4546
/**
4647
* Create an ECS model.
@@ -78,7 +79,7 @@ export class EcsModel extends Construct {
7879
});
7980

8081
// Single bucket for all models
81-
const s3BucketModels = Bucket.fromBucketName(this, 'Bucket', config.s3BucketModels);
82+
const s3BucketModels = Bucket.fromBucketName(this, 'Bucket', config.s3BucketModels ?? '');
8283
s3BucketModels.grantReadWrite(modelCluster.taskRole);
8384

8485
// Update
@@ -94,18 +95,18 @@ export class EcsModel extends Construct {
9495
* @returns {Object} An object containing the environment variables. The object has string keys and values, which
9596
* represent the environment variables for Docker at runtime.
9697
*/
97-
private getEnvironmentVariables (config: Config, modelConfig: EcsClusterConfig): { [key: string]: string } {
98+
private getEnvironmentVariables (config: PartialConfig, modelConfig: EcsClusterConfig): { [key: string]: string } {
9899
const environment: { [key: string]: string } = {
99-
LOCAL_MODEL_PATH: `${config.nvmeContainerMountPath}/model`,
100-
S3_BUCKET_MODELS: config.s3BucketModels,
100+
LOCAL_MODEL_PATH: `${config.nvmeContainerMountPath ?? '/nvme'}/model`,
101+
S3_BUCKET_MODELS: config.s3BucketModels ?? '',
101102
MODEL_NAME: modelConfig.modelName,
102103
LOCAL_CODE_PATH: modelConfig.localModelCode, // Only needed when s5cmd is used, but just keep for now
103-
AWS_REGION: config.region, // needed for s5cmd
104+
AWS_REGION: config.region ?? '', // needed for s5cmd
104105
MANAGEMENT_KEY_NAME: StringParameter.valueForStringParameter(this, `${config.deploymentPrefix}/managementKeySecretName`)
105106
};
106107

107108
if (modelConfig.modelType === 'embedding') {
108-
environment.SAGEMAKER_BASE_DIR = config.nvmeContainerMountPath;
109+
environment.SAGEMAKER_BASE_DIR = config.nvmeContainerMountPath ?? '/nvme';
109110
}
110111

111112
if (config.mountS3DebUrl) {
@@ -134,7 +135,7 @@ export class EcsModel extends Construct {
134135
* @returns {Object} An object containing the build arguments. The object has string keys and values, which represent
135136
* the arguments for the Docker build.
136137
*/
137-
private getBuildArguments (config: Config, modelConfig: EcsClusterConfig): { [key: string]: string } | undefined {
138+
private getBuildArguments (config: PartialConfig, modelConfig: EcsClusterConfig): { [key: string]: string } | undefined {
138139
if (modelConfig.containerConfig.image.type !== EcsSourceType.ASSET) {
139140
return undefined;
140141
}
@@ -149,7 +150,7 @@ export class EcsModel extends Construct {
149150
if (config.mountS3DebUrl) {
150151
buildArgs.MOUNTS3_DEB_URL = config.mountS3DebUrl;
151152
}
152-
if (config.pypiConfig.indexUrl) {
153+
if (config.pypiConfig?.indexUrl) {
153154
buildArgs.PYPI_INDEX_URL = config.pypiConfig.indexUrl;
154155
buildArgs.PYPI_TRUSTED_HOST = config.pypiConfig.trustedHost;
155156
}

‎ecs_model_deployer/src/lib/ecsCluster.ts

+11-10
Original file line numberDiff line numberDiff line change
@@ -43,7 +43,7 @@ import { StringParameter } from 'aws-cdk-lib/aws-ssm';
4343
import { Construct } from 'constructs';
4444

4545
import { createCdkId } from '../../../lib/core/utils';
46-
import { BaseProps, AmiHardwareType, EcsSourceType } from '../../../lib/schema';
46+
import { AmiHardwareType, EcsSourceType, PartialConfig } from '../../../lib/schema';
4747
import { Ec2Metadata, ECSConfig } from '../../../lib/schema';
4848

4949
/**
@@ -62,7 +62,8 @@ type ECSClusterProps = {
6262
subnetSelection?: SubnetSelection;
6363
taskRoleName?: string;
6464
executionRoleName?: string;
65-
} & BaseProps;
65+
config: PartialConfig
66+
};
6667

6768
/**
6869
* Create an ECS model.
@@ -90,7 +91,7 @@ export class ECSCluster extends Construct {
9091
const cluster = new Cluster(this, createCdkId([ecsConfig.identifier, 'Cl']), {
9192
clusterName: createCdkId([config.deploymentName, ecsConfig.identifier], 32, 2),
9293
vpc: vpc,
93-
containerInsightsV2: !config.region.includes('iso') ? ContainerInsights.ENABLED : ContainerInsights.DISABLED,
94+
containerInsightsV2: !config.region?.includes('iso') ? ContainerInsights.ENABLED : ContainerInsights.DISABLED,
9495
});
9596

9697
// Create auto scaling group
@@ -127,7 +128,7 @@ export class ECSCluster extends Construct {
127128
// If NVMe drive available, mount and use it
128129
if (Ec2Metadata.get(ecsConfig.instanceType).nvmePath) {
129130
// EC2 user data to mount ephemeral NVMe drive
130-
const MOUNT_PATH = config.nvmeHostMountPath;
131+
const MOUNT_PATH = config.nvmeHostMountPath ?? '/nvme';
131132
const NVME_PATH = Ec2Metadata.get(ecsConfig.instanceType).nvmePath;
132133
/* eslint-disable no-useless-escape */
133134
const rawUserData = `#!/bin/bash
@@ -155,11 +156,11 @@ export class ECSCluster extends Construct {
155156

156157
// Create mount point for container
157158
const sourceVolume = 'nvme';
158-
const host: Host = { sourcePath: config.nvmeHostMountPath };
159+
const host: Host = { sourcePath: config.nvmeHostMountPath ?? '/nvme' };
159160
const nvmeVolume: Volume = { name: sourceVolume, host: host };
160161
const nvmeMountPoint: MountPoint = {
161162
sourceVolume: sourceVolume,
162-
containerPath: config.nvmeContainerMountPath,
163+
containerPath: config.nvmeContainerMountPath ?? '/nvme',
163164
readOnly: false,
164165
};
165166
volumes.push(nvmeVolume);
@@ -171,7 +172,7 @@ export class ECSCluster extends Construct {
171172
autoScalingGroup.role.addManagedPolicy(ManagedPolicy.fromAwsManagedPolicyName('AmazonSSMFullAccess'));
172173
}
173174

174-
if (config.region.includes('iso')) {
175+
if (config.region?.includes('iso')) {
175176
const pkiSourceVolume = 'pki';
176177
const pkiHost: Host = { sourcePath: '/etc/pki' };
177178
const pkiVolume: Volume = { name: pkiSourceVolume, host: pkiHost };
@@ -184,13 +185,13 @@ export class ECSCluster extends Construct {
184185
mountPoints.push(pkiMountPoint);
185186
// Requires mount point /etc/pki from host
186187
environment.SSL_CERT_DIR = '/etc/pki/tls/certs';
187-
environment.SSL_CERT_FILE = config.certificateAuthorityBundle;
188+
environment.SSL_CERT_FILE = config.certificateAuthorityBundle ?? '';
188189
}
189190

190191
const roleId = ecsConfig.identifier;
191192
const taskRole = taskRoleName ?
192193
Role.fromRoleName(this, createCdkId([config.deploymentName, roleId]), taskRoleName) :
193-
this.createTaskRole(config.deploymentName, config.deploymentPrefix, roleId);
194+
this.createTaskRole(config.deploymentName ?? '', config.deploymentPrefix, roleId);
194195

195196
// Create ECS task definition
196197
const taskDefinition = new Ec2TaskDefinition(this, createCdkId([roleId, 'Ec2TaskDefinition']), {
@@ -263,7 +264,7 @@ export class ECSCluster extends Construct {
263264
daemon: true,
264265
serviceName: createCdkId([config.deploymentName, ecsConfig.identifier], 32, 2),
265266
taskDefinition: taskDefinition,
266-
circuitBreaker: !config.region.includes('iso') ? { rollback: true } : undefined,
267+
circuitBreaker: !config.region?.includes('iso') ? { rollback: true } : undefined,
267268
};
268269

269270
const service = new Ec2Service(this, createCdkId([ecsConfig.identifier, 'Ec2Svc']), serviceProps);

‎ecs_model_deployer/src/lib/lisa_model_stack.ts

+2-2
Original file line numberDiff line numberDiff line change
@@ -21,12 +21,12 @@ import { SecurityGroup, Subnet, SubnetSelection, Vpc } from 'aws-cdk-lib/aws-ec2
2121
import { Construct } from 'constructs';
2222
import { EcsModel } from './ecs-model';
2323

24-
import { Config,EcsClusterConfig } from '../../../lib/schema';
24+
import { EcsClusterConfig, PartialConfig } from '../../../lib/schema';
2525

2626
export type LisaModelStackProps = {
2727
vpcId: string;
2828
securityGroupId: string;
29-
config: Config;
29+
config: PartialConfig;
3030
modelConfig: EcsClusterConfig;
3131
} & StackProps;
3232

‎lib/api-base/authorizer.ts

-1
Original file line numberDiff line numberDiff line change
@@ -97,7 +97,6 @@ export class CustomAuthorizer extends Construct {
9797
JWT_GROUPS_PROP: config.authConfig!.jwtGroupsProperty,
9898
MANAGEMENT_KEY_NAME: managementKeySecretNameStringParameter.stringValue
9999
},
100-
reservedConcurrentExecutions: 5,
101100
role: role,
102101
vpc: vpc.vpc,
103102
securityGroups: securityGroups,

‎lib/api-base/utils.ts

-1
Original file line numberDiff line numberDiff line change
@@ -122,7 +122,6 @@ export function registerAPIEndpoint (
122122
timeout: funcDef.timeout || Duration.seconds(180),
123123
memorySize: 512,
124124
layers,
125-
reservedConcurrentExecutions: 5,
126125
role,
127126
vpc: vpc.vpc,
128127
securityGroups,

‎lib/models/docker-image-builder.ts

-1
Original file line numberDiff line numberDiff line change
@@ -93,7 +93,6 @@ export class DockerImageBuilder extends Construct {
9393
handler: 'dockerimagebuilder.handler',
9494
code: Code.fromAsset('./lambda/'),
9595
timeout: Duration.minutes(1),
96-
reservedConcurrentExecutions: 5,
9796
memorySize: 1024,
9897
role: ec2BuilderRole,
9998
environment: {

‎lib/models/ecs-model-deployer.ts

+6
Original file line numberDiff line numberDiff line change
@@ -52,6 +52,7 @@ export class ECSModelDeployer extends Construct {
5252
const stripped_config = {
5353
'appName': props.config.appName,
5454
'deploymentName': props.config.deploymentName,
55+
'deploymentPrefix': props.config.deploymentPrefix,
5556
'region': props.config.region,
5657
'deploymentStage': props.config.deploymentStage,
5758
'removalPolicy': props.config.removalPolicy,
@@ -60,6 +61,11 @@ export class ECSModelDeployer extends Construct {
6061
'permissionsBoundaryAspect': props.config.permissionsBoundaryAspect,
6162
'subnets': props.config.subnets,
6263
'taskRole': props.config.roles?.ECSModelTaskRole,
64+
'certificateAuthorityBundle': props.config.certificateAuthorityBundle,
65+
'pypiConfig': props.config.pypiConfig,
66+
'nvmeContainerMountPath': props.config.nvmeContainerMountPath,
67+
'nvmeHostMountPath': props.config.nvmeHostMountPath,
68+
'condaUrl': props.config.condaUrl
6369
};
6470

6571
const functionId = createCdkId([stackName, 'ecs_model_deployer']);

‎lib/models/state-machine/create-model.ts

-7
Original file line numberDiff line numberDiff line change
@@ -88,7 +88,6 @@ export class CreateModelStateMachine extends Construct {
8888
code: Code.fromAsset('./lambda'),
8989
timeout: LAMBDA_TIMEOUT,
9090
memorySize: LAMBDA_MEMORY,
91-
reservedConcurrentExecutions: 5,
9291
role: role,
9392
vpc: vpc.vpc,
9493
vpcSubnets: vpc.subnetSelection,
@@ -113,7 +112,6 @@ export class CreateModelStateMachine extends Construct {
113112
code: Code.fromAsset('./lambda'),
114113
timeout: LAMBDA_TIMEOUT,
115114
memorySize: LAMBDA_MEMORY,
116-
reservedConcurrentExecutions: 5,
117115
role: role,
118116
vpc: vpc.vpc,
119117
vpcSubnets: vpc.subnetSelection,
@@ -136,7 +134,6 @@ export class CreateModelStateMachine extends Construct {
136134
code: Code.fromAsset('./lambda'),
137135
timeout: LAMBDA_TIMEOUT,
138136
memorySize: LAMBDA_MEMORY,
139-
reservedConcurrentExecutions: 5,
140137
role: role,
141138
vpc: vpc.vpc,
142139
vpcSubnets: vpc.subnetSelection,
@@ -159,7 +156,6 @@ export class CreateModelStateMachine extends Construct {
159156
code: Code.fromAsset('./lambda'),
160157
timeout: LAMBDA_TIMEOUT,
161158
memorySize: LAMBDA_MEMORY,
162-
reservedConcurrentExecutions: 5,
163159
role: role,
164160
vpc: vpc.vpc,
165161
vpcSubnets: vpc.subnetSelection,
@@ -188,7 +184,6 @@ export class CreateModelStateMachine extends Construct {
188184
code: Code.fromAsset('./lambda'),
189185
timeout: Duration.minutes(8),
190186
memorySize: LAMBDA_MEMORY,
191-
reservedConcurrentExecutions: 5,
192187
role: role,
193188
vpc: vpc.vpc,
194189
vpcSubnets: vpc.subnetSelection,
@@ -211,7 +206,6 @@ export class CreateModelStateMachine extends Construct {
211206
code: Code.fromAsset('./lambda'),
212207
timeout: LAMBDA_TIMEOUT,
213208
memorySize: LAMBDA_MEMORY,
214-
reservedConcurrentExecutions: 5,
215209
role: role,
216210
vpc: vpc.vpc,
217211
vpcSubnets: vpc.subnetSelection,
@@ -240,7 +234,6 @@ export class CreateModelStateMachine extends Construct {
240234
code: Code.fromAsset('./lambda'),
241235
timeout: LAMBDA_TIMEOUT,
242236
memorySize: LAMBDA_MEMORY,
243-
reservedConcurrentExecutions: 5,
244237
role: role,
245238
vpc: vpc.vpc,
246239
vpcSubnets: vpc.subnetSelection,

‎lib/models/state-machine/delete-model.ts

-5
Original file line numberDiff line numberDiff line change
@@ -82,7 +82,6 @@ export class DeleteModelStateMachine extends Construct {
8282
code: Code.fromAsset('./lambda'),
8383
timeout: LAMBDA_TIMEOUT,
8484
memorySize: LAMBDA_MEMORY,
85-
reservedConcurrentExecutions: 5,
8685
role: role,
8786
vpc: vpc.vpc,
8887
vpcSubnets: vpc.subnetSelection,
@@ -105,7 +104,6 @@ export class DeleteModelStateMachine extends Construct {
105104
code: Code.fromAsset('./lambda'),
106105
timeout: LAMBDA_TIMEOUT,
107106
memorySize: LAMBDA_MEMORY,
108-
reservedConcurrentExecutions: 5,
109107
role: role,
110108
vpc: vpc.vpc,
111109
vpcSubnets: vpc.subnetSelection,
@@ -128,7 +126,6 @@ export class DeleteModelStateMachine extends Construct {
128126
code: Code.fromAsset('./lambda'),
129127
timeout: LAMBDA_TIMEOUT,
130128
memorySize: LAMBDA_MEMORY,
131-
reservedConcurrentExecutions: 5,
132129
role: role,
133130
vpc: vpc.vpc,
134131
vpcSubnets: vpc.subnetSelection,
@@ -151,7 +148,6 @@ export class DeleteModelStateMachine extends Construct {
151148
code: Code.fromAsset('./lambda'),
152149
timeout: LAMBDA_TIMEOUT,
153150
memorySize: LAMBDA_MEMORY,
154-
reservedConcurrentExecutions: 5,
155151
role: role,
156152
vpc: vpc.vpc,
157153
vpcSubnets: vpc.subnetSelection,
@@ -174,7 +170,6 @@ export class DeleteModelStateMachine extends Construct {
174170
code: Code.fromAsset('./lambda'),
175171
timeout: LAMBDA_TIMEOUT,
176172
memorySize: LAMBDA_MEMORY,
177-
reservedConcurrentExecutions: 5,
178173
role: role,
179174
vpc: vpc.vpc,
180175
vpcSubnets: vpc.subnetSelection,

‎lib/models/state-machine/update-model.ts

-3
Original file line numberDiff line numberDiff line change
@@ -92,7 +92,6 @@ export class UpdateModelStateMachine extends Construct {
9292
code: Code.fromAsset('./lambda'),
9393
timeout: LAMBDA_TIMEOUT,
9494
memorySize: LAMBDA_MEMORY,
95-
reservedConcurrentExecutions: 5,
9695
role: role,
9796
vpc: vpc.vpc,
9897
vpcSubnets: vpc.subnetSelection,
@@ -115,7 +114,6 @@ export class UpdateModelStateMachine extends Construct {
115114
code: Code.fromAsset('./lambda'),
116115
timeout: LAMBDA_TIMEOUT,
117116
memorySize: LAMBDA_MEMORY,
118-
reservedConcurrentExecutions: 5,
119117
role: role,
120118
vpc: vpc.vpc,
121119
vpcSubnets: vpc.subnetSelection,
@@ -138,7 +136,6 @@ export class UpdateModelStateMachine extends Construct {
138136
code: Code.fromAsset('./lambda'),
139137
timeout: LAMBDA_TIMEOUT,
140138
memorySize: LAMBDA_MEMORY,
141-
reservedConcurrentExecutions: 5,
142139
role: role,
143140
vpc: vpc.vpc,
144141
vpcSubnets: vpc.subnetSelection,

‎lib/serve/index.ts

-1
Original file line numberDiff line numberDiff line change
@@ -117,7 +117,6 @@ export class LisaServeApplicationStack extends Stack {
117117
// },
118118
// layers: [commonLambdaLayer],
119119
// vpc: props.vpc.vpc,
120-
// reservedConcurrentExecutions: 5,
121120
// });
122121

123122
// managementKeySecret.grantRead(rotateManagementKeyLambda);

‎lib/stages.ts

+13-1
Original file line numberDiff line numberDiff line change
@@ -28,7 +28,7 @@ import {
2828
Tags,
2929
} from 'aws-cdk-lib';
3030
import { Construct } from 'constructs';
31-
import { AwsSolutionsChecks, NIST80053R5Checks } from 'cdk-nag';
31+
import { AwsSolutionsChecks, NagSuppressions, NIST80053R5Checks } from 'cdk-nag';
3232

3333
import { LisaChatApplicationStack } from './chat';
3434
import { ARCHITECTURE, CoreStack } from './core';
@@ -307,6 +307,18 @@ export class LisaServeApplicationStage extends Stage {
307307
Aspects.of(lisaStack).add(new ConvertInlinePoliciesToManaged());
308308
});
309309
}
310+
// Nag Suppressions
311+
stacks.forEach((lisaStack) => {
312+
NagSuppressions.addStackSuppressions(
313+
lisaStack,
314+
[
315+
{
316+
id: 'NIST.800.53.R5-LambdaConcurrency',
317+
reason: 'Not applying lambda concurrency limits',
318+
},
319+
],
320+
);
321+
});
310322

311323
// Run CDK-nag on app if specified
312324
if (config.runCdkNag) {

0 commit comments

Comments
 (0)