[WIP] Sagemaker Notebook DirectInternetAccess support #7884

bcatubig · 2019-03-10T19:07:45Z

Enhancement #2999

Changes proposed in this pull request:

Allow user to disable internet access to notebook

Community Note

Please vote on this pull request by adding a 👍 reaction to the original pull request comment to help the community and maintainers prioritize this request
Please do not leave "+1" comments, they generate extra noise for pull request followers and do not help prioritize the request

Output from acceptance testing:

Currently dealing with destroy issues...

make testacc TESTARGS='-run=TestAccAWSSagemakerNotebookInstance_directInternetAccess'

==> Checking that code complies with gofmt requirements...
TF_ACC=1 go test ./aws -v -parallel 20 -run=TestAccAWSSagemakerNotebookInstance_directInternetAccess -timeout 120m
=== RUN   TestAccAWSSagemakerNotebookInstance_directInternetAccess
=== PAUSE TestAccAWSSagemakerNotebookInstance_directInternetAccess
=== CONT  TestAccAWSSagemakerNotebookInstance_directInternetAccess
--- FAIL: TestAccAWSSagemakerNotebookInstance_directInternetAccess (225.45s)
    testing.go:599: Error destroying resource! WARNING: Dangling resources
        may exist. The full state and error is shown below.
        
        Error: Error applying: 1 error occurred:
                * aws_sagemaker_notebook_instance.foo (destroy): 1 error occurred:
                * aws_sagemaker_notebook_instance.foo: error waiting for sagemaker notebook instance (terraform-testacc-20190311022405872400000001) to stop: RequestError: send request failed
        caused by: Post https://api.sagemaker.us-east-1.amazonaws.com/: read tcp 192.168.1.201:57866->34.201.234.253:443: read: connection reset by peer

bflad

Hi @bcatubig 👋 This is looking pretty good. Is there anything else that needs to happen here? Acceptance testing seems to be passing just fine for me, e.g.

--- PASS: TestAccAWSSagemakerNotebookInstance_basic (220.51s)
--- PASS: TestAccAWSSagemakerNotebookInstance_directInternetAccess (295.28s)

bflad · 2019-03-26T00:54:08Z

aws/resource_aws_sagemaker_notebook_instance_test.go

+  cidr_block = "10.0.1.0/24"
+
+  tags = {
+    Name = "Main"


Nit: To prevent confusion for anyone running the acceptance testing in their own accounts it might be good to make this Name tags more descriptive for the test configurations in case the testing leaves dangling resources, e.g.

Suggested change

Name = "Main"

Name = "tf-acc-test-sagemaker-notebook-instance-direct-internet-access"

aws/resource_aws_sagemaker_notebook_instance_test.go

aws/resource_aws_sagemaker_notebook_instance.go

bcatubig · 2019-03-26T16:52:47Z

Thanks @bflad -- will make requested changes

bcatubig · 2019-03-31T23:10:20Z

Hey @bflad

Feedback implemented

bflad

This is almost there, @bcatubig! Two little fixes and should be ready to go. 😄

bflad · 2019-04-01T13:05:45Z

aws/resource_aws_sagemaker_notebook_instance_test.go

+	})
+}
+
+func TestAccAWSSagemakerNotebookInstance_directInternetAccess_enabled(t *testing.T) {


It looks like this acceptance test is failing while the others pass:

--- FAIL: TestAccAWSSagemakerNotebookInstance_directInternetAccess_enabled (255.12s) testing.go:538: Step 0 error: Check failed: Check 3/5 error: DirectInternetAccess not configured correctly: want Enabled got Disabled --- PASS: TestAccAWSSagemakerNotebookInstance_basic (259.02s) --- PASS: TestAccAWSSagemakerNotebookInstance_directInternetAccess_disabled (292.10s) --- PASS: TestAccAWSSagemakerNotebookInstance_tags (296.42s) --- PASS: TestAccAWSSagemakerNotebookInstance_disappears (314.73s) --- PASS: TestAccAWSSagemakerNotebookInstance_update (443.07s)

Did you mean to point it to the same direct_internet_access = "Disabled" configuration? The easiest fix might be to parameterize that argument for the configuration:

func testAccAWSSagemakerNotebookInstanceConfigDirectInternetAccess(notebookName, directInternetAccess string) string { return fmt.Sprintf(` resource "aws_vpc" "main" { cidr_block = "10.0.0.0/16" } resource "aws_subnet" "main" { vpc_id = "${aws_vpc.main.id}" cidr_block = "10.0.1.0/24" tags = { Name = "tf-acc-test-sagemaker-notebook-instance-direct-internet-access" } } resource "aws_security_group" "foo" { name = "foo" vpc_id = "${aws_vpc.main.id}" description = "foo bar baz" tags = { Name = "foo_sg" } } resource "aws_sagemaker_notebook_instance" "foo" { name = %[1]q role_arn = "${aws_iam_role.foo.arn}" instance_type = "ml.t2.medium" subnet_id = "${aws_subnet.main.id}" security_groups = ["${aws_security_group.foo.id}"] direct_internet_access = %[2]q } resource "aws_iam_role" "foo" { name = %[1]q path = "/" assume_role_policy = "${data.aws_iam_policy_document.assume_role.json}" } data "aws_iam_policy_document" "assume_role" { statement { actions = ["sts:AssumeRole"] principals { type = "Service" identifiers = ["sagemaker.amazonaws.com"] } } } `, notebookName, directInternetAccess) }

Then updating the two Config calls:

// in TestAccAWSSagemakerNotebookInstance_directInternetAccess_disabled Config: testAccAWSSagemakerNotebookInstanceConfigDirectInternetAccess(notebookName, "Disabled"), // in TestAccAWSSagemakerNotebookInstance_directInternetAccess_enabled Config: testAccAWSSagemakerNotebookInstanceConfigDirectInternetAccess(notebookName, "Enabled"),

I'll refactor this

bflad · 2019-04-01T13:06:41Z

website/docs/r/sagemaker_notebook_instance.html.markdown

@@ -36,6 +36,7 @@ The following arguments are supported:
 * `subnet_id` - (Optional) The VPC subnet ID.
 * `security_groups` - (Optional) The associated security groups.
 * `kms_key_id` - (Optional) The AWS Key Management Service (AWS KMS) key that Amazon SageMaker uses to encrypt the model artifacts at rest using Amazon S3 server-side encryption.
+* `direct_internet_access` - (Optional) Set to `Disabled` to disable internet access to notebook. Requires `subnet_id` to be set.


We should mention this supports Enabled as well (for Terraform modules, etc.)

Suggested change

* `direct_internet_access` - (Optional) Set to `Disabled` to disable internet access to notebook. Requires `subnet_id` to be set.

* `direct_internet_access` - (Optional) Set to `Disabled` to disable internet access to notebook. Requires `subnet_id` to be set. Valid values: `Disabled`, `Enabled`.

Hey @bflad, is there specific format for parameters that support multiple values?

Ex:

foo - (Optional). Foo does a thing. Supported values: Enabled or Disabled

I lean towards Valid values: one, two but I'm not sure if there is a specific "format". Its more important they are listed in some way.

bcatubig · 2019-04-05T14:26:30Z

Totally nuked this by accident. Will fix tonight when I have access to my other computer.

rainmanh · 2019-04-29T13:15:51Z

What is the status for this @bcatubig ?

chrispruitt · 2019-05-09T17:22:41Z

@bcatubig is the direct_internet_access option available in any specific version yet? many thanks

bcatubig · 2019-05-12T14:17:31Z

Hello, I still need to fix this pr. Will get it sorted out as there are only a few items left. Thanks

…

On Thu, May 9, 2019 at 12:22 PM, chrispruitt ***@***.***> wrote: ***@***.***(https://github.com/bcatubig) is the direct_internet_access option available in any specific version yet? many thanks — You are receiving this because you were mentioned. Reply to this email directly, [view it on GitHub](#7884 (comment)), or [mute the thread](https://github.com/notifications/unsubscribe-auth/AAKR3YBLOK4KWMYXYQG4BXLPURMW5ANCNFSM4G45YS6Q).

sworisbreathing · 2019-06-17T05:18:00Z

hi @bcatubig - has there been any movement on fixing up this PR? I'm pretty keen on seeing this config option exposed through terraform.

bcatubig · 2019-06-17T19:29:54Z

Hey @sworisbreathing -- this has been moved to #8618

ghost · 2019-11-03T15:30:11Z

I'm going to lock this issue because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues.

If you feel this issue should be reopened, we encourage creating a new issue linking back to this one for added context. Thanks!

bcatubig mentioned this pull request Mar 10, 2019

Add SageMaker support #2493

Closed

bflad mentioned this pull request Mar 26, 2019

[WIP] Update aws_sagemaker_instance resource #8011

Closed

bflad added the enhancement Requests to existing resources that expand the functionality or scope. label Mar 26, 2019

bflad reviewed Mar 26, 2019

View reviewed changes

bflad added the waiting-response Maintainers are waiting on response from community or contributor. label Mar 26, 2019

ghost removed the waiting-response Maintainers are waiting on response from community or contributor. label Mar 26, 2019

bflad added the waiting-response Maintainers are waiting on response from community or contributor. label Mar 27, 2019

ghost removed the waiting-response Maintainers are waiting on response from community or contributor. label Mar 31, 2019

bflad reviewed Apr 1, 2019

View reviewed changes

bflad added the waiting-response Maintainers are waiting on response from community or contributor. label Apr 1, 2019

bcatubig closed this Apr 5, 2019

ghost added size/XS Managed by automation to categorize the size of a PR. and removed size/M Managed by automation to categorize the size of a PR. labels Apr 5, 2019

ghost removed the waiting-response Maintainers are waiting on response from community or contributor. label Apr 5, 2019

ghost locked and limited conversation to collaborators Nov 3, 2019

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

[WIP] Sagemaker Notebook DirectInternetAccess support #7884

[WIP] Sagemaker Notebook DirectInternetAccess support #7884

bcatubig commented Mar 10, 2019 •

edited

Loading

bflad left a comment

bflad Mar 26, 2019

bcatubig commented Mar 26, 2019

bcatubig commented Mar 31, 2019

bflad left a comment

bflad Apr 1, 2019

bcatubig Apr 1, 2019

bflad Apr 1, 2019

bcatubig Apr 1, 2019

bflad Apr 1, 2019 •

edited

Loading

bcatubig commented Apr 5, 2019

rainmanh commented Apr 29, 2019

chrispruitt commented May 9, 2019

bcatubig commented May 12, 2019 via email

sworisbreathing commented Jun 17, 2019

bcatubig commented Jun 17, 2019

ghost commented Nov 3, 2019

	Name = "Main"
	Name = "tf-acc-test-sagemaker-notebook-instance-direct-internet-access"

	* `direct_internet_access` - (Optional) Set to `Disabled` to disable internet access to notebook. Requires `subnet_id` to be set.
	* `direct_internet_access` - (Optional) Set to `Disabled` to disable internet access to notebook. Requires `subnet_id` to be set. Valid values: `Disabled`, `Enabled`.

[WIP] Sagemaker Notebook DirectInternetAccess support #7884

[WIP] Sagemaker Notebook DirectInternetAccess support #7884

Conversation

bcatubig commented Mar 10, 2019 • edited Loading

Community Note

bflad left a comment

Choose a reason for hiding this comment

bflad Mar 26, 2019

Choose a reason for hiding this comment

bcatubig commented Mar 26, 2019

bcatubig commented Mar 31, 2019

bflad left a comment

Choose a reason for hiding this comment

bflad Apr 1, 2019

Choose a reason for hiding this comment

bcatubig Apr 1, 2019

Choose a reason for hiding this comment

bflad Apr 1, 2019

Choose a reason for hiding this comment

bcatubig Apr 1, 2019

Choose a reason for hiding this comment

bflad Apr 1, 2019 • edited Loading

Choose a reason for hiding this comment

bcatubig commented Apr 5, 2019

rainmanh commented Apr 29, 2019

chrispruitt commented May 9, 2019

bcatubig commented May 12, 2019 via email

sworisbreathing commented Jun 17, 2019

bcatubig commented Jun 17, 2019

ghost commented Nov 3, 2019

bcatubig commented Mar 10, 2019 •

edited

Loading

bflad Apr 1, 2019 •

edited

Loading