amazon-web-services - 具有认知能力的 Sagemaker 劳动力

Question

我正在尝试使用私有(private)认知为 sagemaker 私有(private)劳动力构建 terraform

正在关注:https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/sagemaker_workforce

工作正常

ma​​in.tf

resource "aws_sagemaker_workforce" "workforce" {
  workforce_name = "workforce"

  cognito_config {
    client_id = aws_cognito_user_pool_client.congnito_client.id
    user_pool = aws_cognito_user_pool_domain.domain.user_pool_id
  }
}

resource "aws_cognito_user_pool" "user_pool" {
  name = "sagemaker-cognito-userpool"
}

resource "aws_cognito_user_pool_client" "congnito_client" {
  name            = "congnito-client"
  generate_secret = true
  user_pool_id    = aws_cognito_user_pool.user_pool.id
}

resource "aws_cognito_user_group" "user_group" {
  name         = "user-group"
  user_pool_id = aws_cognito_user_pool.user_pool.id
}

resource "aws_cognito_user_pool_domain" "domain" {
  domain       = "sagemaker-user-pool-ocr-domain"
  user_pool_id = aws_cognito_user_pool.user_pool.id
}

resource "aws_sagemaker_workteam" "workteam" {
  workteam_name  = "worker-team"
  workforce_name = aws_sagemaker_workforce.workforce.id
  description    = "worker-team"

  member_definition {
    cognito_member_definition {
      client_id  = aws_cognito_user_pool_client.congnito_client.id
      user_pool  = aws_cognito_user_pool_domain.domain.user_pool_id
      user_group = aws_cognito_user_group.user_group.id
    }
  }
}

resource "aws_sagemaker_human_task_ui" "template" {
  human_task_ui_name = "human-task-ui-template"

  ui_template {
    content = file("${path.module}/sagemaker-human-task-ui-template.html")
  }
}

resource "aws_sagemaker_flow_definition" "definition" {
  flow_definition_name = "flow-definition"
  role_arn             = var.aws_iam_role

  human_loop_config {
    human_task_ui_arn                     = aws_sagemaker_human_task_ui.template.arn
    task_availability_lifetime_in_seconds = 1
    task_count                            = 1
    task_description                      = "Task description"
    task_title                            = "Please review the Key Value Pairs in this document"
    workteam_arn                          = aws_sagemaker_workteam.workteam.arn
  }

  output_config {
    s3_output_path = "s3://${var.s3_output_path}"
  }
}

它正在创建带有回调 URL 的 Cognito 用户池。这些回调 URL 来自 aws_sagemaker_workforce.workforce.subdomain 并自动设置为 cognito，这就是我想要的。

但我也想在cognitouserpool中设置config

allowed_oauth_flows = ["code", "implicit"]
  allowed_oauth_scopes = ["email", "openid", "profile"]

现在，当我在两行上方添加时，我们还需要添加我不想要的 callbackurl。

我试过了

allowed_oauth_flows = ["code", "implicit"]
  allowed_oauth_scopes = ["email", "openid", "profile"]
  callback_urls = [aws_sagemaker_workforce.workforce.subdomain]

这是给错误:

Cycle: module.sagemaker.aws_cognito_user_pool_client.congnito_client, module.sagemaker.aws_sagemaker_workforce.workforce

因为这两个资源相互依赖，我想传递这两行，但它也迫使我添加回调 url。

这是最后的 ma​​in.tf，它因 three 行而失败

resource "aws_sagemaker_workforce" "workforce" {
  workforce_name = "workforce"

  cognito_config {
    client_id = aws_cognito_user_pool_client.congnito_client.id
    user_pool = aws_cognito_user_pool_domain.domain.user_pool_id
  }
}

resource "aws_cognito_user_pool" "user_pool" {
  name = "sagemaker-cognito-userpool"
}

resource "aws_cognito_user_pool_client" "congnito_client" {
  name            = "congnito-client"
  generate_secret = true
  user_pool_id    = aws_cognito_user_pool.user_pool.id

  explicit_auth_flows                  = ["ALLOW_REFRESH_TOKEN_AUTH", "ALLOW_USER_PASSWORD_AUTH", "ALLOW_CUSTOM_AUTH", "ALLOW_USER_SRP_AUTH"]
  allowed_oauth_flows_user_pool_client = true
  supported_identity_providers = ["COGNITO"]

  allowed_oauth_flows = ["code", "implicit"]
  allowed_oauth_scopes = ["email", "openid", "profile"]
  callback_urls = [aws_sagemaker_workforce.workforce.subdomain]
}

resource "aws_cognito_user_group" "user_group" {
  name         = "user-group"
  user_pool_id = aws_cognito_user_pool.user_pool.id
}

resource "aws_cognito_user_pool_domain" "domain" {
  domain       = "sagemaker-user-pool-ocr-domain"
  user_pool_id = aws_cognito_user_pool.user_pool.id
}

resource "aws_sagemaker_workteam" "workteam" {
  workteam_name  = "worker-team"
  workforce_name = aws_sagemaker_workforce.workforce.id
  description    = "worker-team"

  member_definition {
    cognito_member_definition {
      client_id  = aws_cognito_user_pool_client.congnito_client.id
      user_pool  = aws_cognito_user_pool_domain.domain.user_pool_id
      user_group = aws_cognito_user_group.user_group.id
    }
  }
}

resource "aws_sagemaker_human_task_ui" "template" {
  human_task_ui_name = "human-task-ui-template"

  ui_template {
    content = file("${path.module}/sagemaker-human-task-ui-template.html")
  }
}

resource "aws_sagemaker_flow_definition" "definition" {
  flow_definition_name = "flow-definition"
  role_arn             = var.aws_iam_role

  human_loop_config {
    human_task_ui_arn                     = aws_sagemaker_human_task_ui.template.arn
    task_availability_lifetime_in_seconds = 1
    task_count                            = 1
    task_description                      = "Task description"
    task_title                            = "Please review the Key Value Pairs in this document"
    workteam_arn                          = aws_sagemaker_workteam.workteam.arn
  }

  output_config {
    s3_output_path = "s3://${var.s3_output_path}"
  }
}

Answer 1

您不需要为劳动力指定回调 URL。指定以下内容即可创建 aws_cognito_user_pool_client资源:

callback_urls = [
    "https://${aws_cognito_user_pool_domain.domain>.cloudfront_distribution_arn}",
]

然后您在劳动力定义中引用用户池客户端:

resource "aws_sagemaker_workforce" "..." {
    workforce_name = "..."

    cognito_config {
        client_id = aws_cognito_user_pool_client.<client_name>.id
        user_pool = aws_cognito_user_pool_domain.<domain_name>.user_pool_id
    }
}

通过运行 aws cognito-idp describe-user-pool-client --user-pool-id <pool_id> --client-id <client_id> 应用 terraform 配置后，可以证明回调 URL 的存在。 :

"UserPoolClient": {
    ...
    "CallbackURLs": [
        "https://____.cloudfront.net",
        "https://____.labeling.eu-central-1.sagemaker.aws/oauth2/idpresponse"
    ],
    "LogoutURLs": [
        "https://____.labeling.eu-central-1.sagemaker.aws/logout"
    ],

似乎 Terraform 本身在劳动力创造方面没有做任何特别的事情(参见 https://github.com/hashicorp/terraform-provider-aws/blob/main/internal/service/sagemaker/workforce.go)。所以回调 url 似乎是由 AWS SageMaker 自己添加的。

这意味着您必须指示 terraform 忽略 aws_cognito_user_pool_client 中那些属性的更改配置:

lifecycle {
    ignore_changes = [
        callback_urls, logout_urls
    ]
}