one-click-launch.yaml

AWSTemplateFormatVersion: 2010-09-09
Description: Creates AIOps setup for Developers
Parameters:
  VersionTag:
    Type: String
    Default: v1.6.0
    Description: Version. Should reference version tag in the repository e.g v1.6.0.
  ManifestPath:
    Type: String
    Default: manifests/mlops-sagemaker/deployment.yaml
    AllowedValues:
      - manifests/mlops-sagemaker/deployment.yaml
      - manifests/mlflow-experiments-tracking/deployment.yaml
      - manifests/mwaa-ml-training/deployment.yaml
      - manifests/fmops-qna-rag/deployment.yaml
      - manifests/ray-on-eks/deployment.yaml
    Description: Manifest to deploy. Must match one of the manifests in the repository.
Resources:
  CodeBuildRole:
    Type: AWS::IAM::Role
    Properties:
      Path: /
      AssumeRolePolicyDocument:
        Statement:
          - Action: sts:AssumeRole
            Effect: Allow
            Principal:
              Service: codebuild.amazonaws.com
      ManagedPolicyArns:
        - !Sub arn:${AWS::Partition}:iam::aws:policy/AWSCodeBuildAdminAccess
      Policies:
        - PolicyName: cdk-bootstrap-policy
          PolicyDocument:
            Version: "2012-10-17"
            Statement:
              - Sid: CFN
                Effect: Allow
                Action:
                  - cloudformation:DescribeStacks
                  - cloudformation:CreateChangeSet
                  - cloudformation:DescribeChangeSet
                  - cloudformation:ExecuteChangeSet
                  - cloudformation:GetTemplate
                  - cloudformation:DescribeStackEvents
                  - cloudformation:DeleteStack
                  - cloudformation:DeleteChangeSet
                Resource:
                  - !Sub arn:${AWS::Partition}:cloudformation:${AWS::Region}:${AWS::AccountId}:stack/CDKToolkit
                  - !Sub arn:${AWS::Partition}:cloudformation:${AWS::Region}:${AWS::AccountId}:stack/CDKToolkit/*
                  - !Sub arn:${AWS::Partition}:cloudformation:us-east-1:${AWS::AccountId}:stack/CDKToolkit
                  - !Sub arn:${AWS::Partition}:cloudformation:us-east-1:${AWS::AccountId}:stack/CDKToolkit/*
              - Sid: IAM
                Effect: Allow
                Action:
                  - iam:GetRole
                  - iam:CreateRole
                  - iam:AttachRolePolicy
                  - iam:DetachRolePolicy
                  - iam:DeleteRole
                  - iam:PutRolePolicy
                  - iam:DeleteRolePolicy
                  - iam:GetRolePolicy
                  - iam:TagRole
                  - iam:UpdateAssumeRolePolicy
                Resource: !Sub arn:${AWS::Partition}:iam::${AWS::AccountId}:role/cdk-*
              - Sid: ECR
                Effect: Allow
                Action:
                  - ecr:CreateRepository
                  - ecr:DeleteRepository
                  - ecr:SetRepositoryPolicy
                  - ecr:PutLifecyclePolicy
                  - ecr:PutImageTagMutability
                  - ecr:Describe*
                  - ecr:List*
                Resource:
                  - !Sub arn:${AWS::Partition}:ecr:${AWS::Region}:${AWS::AccountId}:repository/cdk-*
                  - !Sub arn:${AWS::Partition}:ecr:us-east-1:${AWS::AccountId}:repository/cdk-*
              - Sid: SSM
                Effect: Allow
                Action:
                  - ssm:PutParameter
                  - ssm:DeleteParameter
                  - ssm:GetParameters
                Resource:
                  - !Sub arn:${AWS::Partition}:ssm:${AWS::Region}:${AWS::AccountId}:parameter/cdk-*
                  - !Sub arn:${AWS::Partition}:ssm:us-east-1:${AWS::AccountId}:parameter/cdk-*
              - Sid: S3
                Effect: Allow
                Action:
                  - s3:CreateBucket
                  - s3:GetBucketPolicy
                  - s3:PutBucketPolicy
                  - s3:PutBucketVersioning
                  - s3:PutBucketPublicAccessBlock
                  - s3:PutBucketAcl
                  - s3:GetEncryptionConfiguration
                  - s3:PutEncryptionConfiguration
                  - s3:PutLifecycleConfiguration
                  - s3:PutObjectTagging
                  - s3:PutObjectVersionTagging
                  - s3:DeleteObjectTagging
                  - s3:DeleteObjectVersionTagging
                Resource:
                  - !Sub arn:${AWS::Partition}:s3:::cdk-*
        - PolicyName: seedfarmer-policy
          PolicyDocument:
            Version: "2012-10-17"
            Statement:
              - Sid: Logs
                Effect: Allow
                Action:
                  - logs:CreateLogGroup
                  - logs:CreateLogStream
                  - logs:PutLogEvents
                Resource:
                  - !Sub arn:${AWS::Partition}:logs:${AWS::Region}:${AWS::AccountId}:log-group:/aws/codebuild/*:*
              - Sid: CFN
                Effect: Allow
                Action:
                  - cloudformation:DescribeStacks
                  - cloudformation:CreateChangeSet
                  - cloudformation:DescribeChangeSet
                  - cloudformation:ExecuteChangeSet
                  - cloudformation:GetTemplate
                  - cloudformation:DescribeStackEvents
                  - cloudformation:DeleteStack
                  - cloudformation:DeleteChangeSet
                Resource:
                  - !Sub arn:${AWS::Partition}:cloudformation:${AWS::Region}:${AWS::AccountId}:stack/seedfarmer-aiops-*
                  - !Sub arn:${AWS::Partition}:cloudformation:${AWS::Region}:${AWS::AccountId}:stack/seedfarmer-aiops-*/*
                  - !Sub arn:${AWS::Partition}:cloudformation:${AWS::Region}:${AWS::AccountId}:stack/aws-codeseeder-aiops
                  - !Sub arn:${AWS::Partition}:cloudformation:${AWS::Region}:${AWS::AccountId}:stack/aws-codeseeder-aiops/*
              - Sid: IAM
                Effect: Allow
                Action:
                  - iam:GetRole
                  - iam:CreateRole
                  - iam:AttachRolePolicy
                  - iam:DetachRolePolicy
                  - iam:DeleteRole
                  - iam:PutRolePolicy
                  - iam:DeleteRolePolicy
                  - iam:GetRolePolicy
                  - iam:TagRole
                  - iam:UpdateAssumeRolePolicy
                Resource:
                  - !Sub arn:${AWS::Partition}:iam::${AWS::AccountId}:role/seedfarmer-aiops-toolchain-role
                  - !Sub arn:${AWS::Partition}:iam::${AWS::AccountId}:role/seedfarmer-aiops-deployment-role

  CreateUpdateCodeBuildProject:
    Type: AWS::CodeBuild::Project
    Properties:
      Description: Builds AIOps Solution Using Seedfarmer
      ServiceRole: !GetAtt CodeBuildRole.Arn
      Artifacts:
        Type: NO_ARTIFACTS
      TimeoutInMinutes: 480
      Environment:
        Type: LINUX_CONTAINER
        ComputeType: BUILD_GENERAL1_LARGE
        Image: aws/codebuild/standard:7.0
        EnvironmentVariables:
          - Name: AWS_ACCOUNT_ID
            Value: !Ref AWS::AccountId
          - Name: AWS_REGION
            Value: !Ref AWS::Region
          - Name: AWS_DEFAULT_REGION
            Value: !Ref AWS::Region
          - Name: PRIMARY_ACCOUNT
            Value: !Ref AWS::AccountId
          - Name: PRIMARY_REGION
            Value: !Ref AWS::Region
          - Name: VERSION_TAG
            Value: !Ref VersionTag
          - Name: MANIFEST_PATH
            Value: !Ref ManifestPath
          - Name: ROLE_ARN
            Value: !GetAtt CodeBuildRole.Arn
          - Name: url_path
            Value: placeholder
          - Name: url_query
            Value: placeholder
          - Name: cfn_signal_url
            Value: placeholder
          - Name: cfn_stack_id
            Value: placeholder
          - Name: cfn_logical_resource_id
            Value: placeholder
          - Name: cfn_request_id
            Value: placeholder
      Source:
        Type: NO_SOURCE
        BuildSpec: |
          version: 0.2
          env:
            shell: bash
          phases:
            install:
              runtime-versions:
                python: 3.11
                nodejs: 18
            pre_build:
              commands:
                - pip install seed-farmer
                - apt-get install jq git
                - npm install -g aws-cdk
            build:
              commands:
                - echo Build started on `date`
                - echo 'Cloning aiops repo...'
                - git clone https://github.com/awslabs/aiops-modules.git --tag ${VERSION_TAG}
                - echo 'Cloning complete'
                - cd aiops-modules/
                - echo 'Installing dependencies...'
                - pip install -r requirements.txt
                - echo 'Python environment setup complete'
                - echo 'Bootstrapping CDK...'
                - cdk bootstrap aws://${AWS_ACCOUNT_ID}/${AWS_REGION}
                - echo 'CDK bootstrap complete'
                - echo 'Boostrapping CDK in us-east-1...'
                - cdk bootstrap aws://${AWS_ACCOUNT_ID}/us-east-1
                - echo 'CDK bootstrap complete in us-east-1'
                - echo 'Bootstrapping seedfarmer...'
                - seedfarmer bootstrap toolchain --project aiops --trusted-principal ${ROLE_ARN} --as-target
                - python scripts/role_assume_update.py ${ROLE_ARN}
                - echo 'Sleeping 120 seconds after role update'
                - sleep 120
                - echo 'Preparing Manifest files'
                - sed -i "s/us-east-1/${AWS_REGION}/g" manifests/*.yaml
                - echo 'Deploying AIOPS manifest'
                - seedfarmer apply ${MANIFEST_PATH} --region ${AWS_REGION} --enable-session-timeout
                - echo 'Deployment of aiops-modules manifest complete'
            post_build:
              commands:
                - echo Build completed on `date`
                - echo Signal back if we have gotten this far
                - echo url_path - $url_path
                - echo url_query - $url_query
                - export UUID=1233244324
                - |
                  STATUS='SUCCESS'
                  if [ $CODEBUILD_BUILD_SUCCEEDING -ne 1 ] # Test if the build is failing
                  then
                    STATUS='FAILURE'
                  fi
                  cat <<EOF > /tmp/payload.json
                  {
                    "UniqueId": "$UUID",
                    "Status": "$STATUS",
                    "Reason": "$STATUS",
                    "Data": "Deployment of solution has finished or stopped. See status."
                  }
                  EOF
                  cat /tmp/payload.json
                  echo "Calling Callback URL: ${cfn_signal_url}"
                  curl -T /tmp/payload.json "$cfn_signal_url"

  CodeBuildRun:
    Type: AWS::CloudFormation::CustomResource
    Properties:
      ServiceToken: !GetAtt CodeBuildLambda.Arn
      BuildProjectName: !Ref CreateUpdateCodeBuildProject
      CallbackUrl: !Ref CodeBuildRunWaitConditionHandler01

  CodeBuildRunWaitConditionHandler01:
    Type: AWS::CloudFormation::WaitConditionHandle

  CodeBuildRunWaitCondition:
    Type: AWS::CloudFormation::WaitCondition
    DependsOn: CodeBuildRun
    Properties:
      Count: 1
      Handle: !Ref CodeBuildRunWaitConditionHandler01
      Timeout: 18000

  CodeBuildLambda:
    Type: AWS::Lambda::Function
    Properties:
      Code:
        ZipFile: |
          import http.client
          import urllib.parse
          import json
          import boto3
          import traceback

          def lambda_handler(event, context):
              account_id = context.invoked_function_arn.split(":")[4]

              try:
                  print(("Received event: " + json.dumps(event, indent=2)))
                  response = get_response_dict(event)

                  if event['RequestType'] in ("Create", "Update"):
                      try:
                          print("Kicking off Build")
                          execute_build(event, event["ResourceProperties"]["BuildProjectName"])
                          send_response(event, get_response_dict(event), "SUCCESS")
                      except Exception as build_exce:
                          print("ERROR: Build threw exception")
                          print((repr(build_exce)))
                          return send_response(event, get_response_dict(event),
                                              "FAILED", repr(build_exce))
                      else:
                          print("Build Kicked off ok CodeBuild should signal back")
                          return
                  elif event['RequestType'] == "Delete":
                      try:
                          send_response(event, get_response_dict(event), "SUCCESS")
                      except Exception as response_exce:
                          print("ERROR: Send Response threw exception")
                          print((repr(response_exce)))
                          return send_response(event, get_response_dict(event),
                                              "FAILED", repr(response_exce))
                      else:
                          return
                  else:
                      print("ERROR: Invalid request type send error signal to cfn")
                      print("ERROR: Expected - Create, Update, Delete")
              except Exception as unhandled:
                  response = get_response_dict(event)
                  return send_response(event, response, "FAILED",
                                      "Unhandled exception, failing gracefully: " + str(unhandled))

          def execute_build(event, project_name):
              """Kickoff CodeBuild Project."""
              build = boto3.client('codebuild')
              signal_url = event["ResourceProperties"]["CallbackUrl"]
              stack_id = event["StackId"]
              request_id = event["RequestId"]
              logical_resource_id = event["LogicalResourceId"]
              url = urllib.parse.urlparse(event['ResponseURL'])
              response = build.start_build(
                  projectName=project_name, environmentVariablesOverride=[
                      {'name': 'url_path', 'value': url.path},
                      {'name': 'url_query', 'value': url.query},
                      {'name': 'cfn_signal_url', 'value': signal_url},
                      {'name': 'cfn_stack_id', 'value': stack_id},
                      {'name': 'cfn_request_id', 'value': request_id},
                      {'name': 'cfn_logical_resource_id', 'value': logical_resource_id}
                  ])
              return response

          def get_response_dict(event):
              response = {
                  'StackId': event['StackId'],
                  'RequestId': event['RequestId'],
                  'LogicalResourceId': event['LogicalResourceId'],
                  'Status': 'SUCCESS',
                  'PhysicalResourceId': 'SeedFarmerDeployment'
              }
              return response

          def send_response(event, response, status=None, reason=None):
              if status is not None:
                  response['Status'] = status

              if reason is not None:
                  response['Reason'] = reason

              if 'ResponseURL' in event and event['ResponseURL']:
                  url = urllib.parse.urlparse(event['ResponseURL'])
                  body = json.dumps(response)
                  https = http.client.HTTPSConnection(url.hostname)
                  https.request('PUT', url.path+'?'+url.query, body)
                  print("Sent CFN Response")

              return response
      Handler: index.lambda_handler
      Runtime: python3.12
      Timeout: 300
      Role: !GetAtt CodeBuildLambdaExecutionRole.Arn

  CodeBuildLambdaExecutionRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Version: "2012-10-17"
        Statement:
          - Effect: Allow
            Principal:
              Service:
                - lambda.amazonaws.com
            Action:
              - sts:AssumeRole
      Path: "/"
      Policies:
        - PolicyName: root
          PolicyDocument:
            Version: "2012-10-17"
            Statement:
              - Effect: Allow
                Action:
                  - codebuild:StartBuild
                Resource:
                  - !GetAtt CreateUpdateCodeBuildProject.Arn
              - Effect: Allow
                Action:
                  - logs:CreateLogGroup
                  - logs:CreateLogStream
                  - logs:PutLogEvents
                Resource: !Sub arn:${AWS::Partition}:logs:*:*:*