personalize_getting_started.yaml

---
AWSTemplateFormatVersion: 2010-09-09
Description: Creates an S3 Bucket, IAM Roles & Policy, SSM Parameters, Lambda Function and SageMaker Notebook to work with Amazon Personalize.

Parameters:
  BucketName:
    Type: String
    Default: personalizedemofirstnamelastname
    Description: The name of the S3 Bucket to create, use only lowercase characters and numbers, no special characters or spaces.

  NotebookName:
    Type: String
    Default: PersonalizeDemoLab
    Description: Enter the name of the SageMaker notebook instance. Default is PersonalizeDemoLab.

  VolumeSize:
    Type: Number
    Default: 10
    MinValue: 5
    MaxValue: 16384
    ConstraintDescription: Must be an integer between 5 (GB) and 16384 (16 TB).
    Description: Enter the size of the EBS volume in GB.

Metadata:
  AWS::CloudFormation::Interface:
    ParameterLabels:
      BucketName:
        default: Amazon S3 Bucket Name
      NotebookName:
        default: Amazon SageMaker Notebook Name
      VolumeSize:
        default: Size (in GB) of the Amazon SageMaker Notebook volume

Resources:
  # Amazon S3 Bucket
  # ---
  S3Bucket:
    Type: AWS::S3::Bucket
    Properties:
      BucketName: !Ref BucketName
      # Tagging Ressources to leverage SSM's Application Manager.
      # ---
      Tags:
        - Key: AppManagerCFNStackKey
          Value: !Ref 'AWS::StackId'

  # AWS Cloudformation Custom Resource
  # ---
  # This custom resource calls AWS Lambda Function "BucketJanitor" before
  # deleting the bucket as AWS Cloudformation doesn't allow to delete
  # non-empty buckets.
  EmptyS3BucketOnDelete:
    Type: Custom::janitor
    Properties:
      ServiceToken:
        Fn::GetAtt:
          - "BucketJanitor"
          - "Arn"
      BucketName: !Ref S3Bucket
    DependsOn: AmazonS3BucketAccessPolicy

  # AWS Lambda function
  # ---
  # This function will empty the Amazon S3 Bucket "S3Bucket" upon stack
  # deletion.
  BucketJanitor:
    Type: AWS::Lambda::Function
    Properties:
      Code:
        ZipFile:
          !Sub |
            #!/usr/bin/env python
            # -*- coding: utf-8 -*-

            import boto3, logging
            import cfnresponse

            logger = logging.getLogger()
            logger.setLevel(logging.INFO)

            def lambda_handler(event, context):
                logger.info("event: {}".format(event))
                try:
                    bucket = event['ResourceProperties']['BucketName']
                    logger.info("bucket: {}, event['RequestType']: {}".format(bucket,event['RequestType']))
                    # ---
                    # We only trigger the janitor if Cloudformation wants to
                    # delete the bucket (via a Custom Resource)
                    # ---
                    if event['RequestType'] == 'Delete':
                        s3 = boto3.resource('s3')
                        # ---
                        # convert bucket to string
                        # ---
                        bucket = str(bucket)
                        bucket_versioning_status = s3.BucketVersioning(bucket)
                        bucket = s3.Bucket(bucket)
                        # ---
                        # is versioning enabled ?
                        # ---
                        if bucket_versioning_status.status == 'Enabled':
                            print("### Bucket Versioning is enabled")
                            object_keys = []
                            # ---
                            # listing all object versions and adding them to an array.
                            # ---
                            for version in bucket.object_versions.all():
                                if version.object_key not in object_keys:
                                    object_keys.append(version.object_key)
                            # ---
                            # deleting all the object versions in our array.
                            # ---
                            for key in object_keys:
                                print("deleting: " + key)
                                bucket.object_versions.filter(Prefix=key).delete()
                        else:
                            print("### Bucket Versioning is NOT enabled")
                            # ---
                            # delete all the objects
                            # ---
                            bucket.objects.all().delete()
                    # ---
                    # triger sendResponseCfn() to signal back to Cloudformation
                    # that all went well.
                    # ---
                    sendResponseCfn(event, context, cfnresponse.SUCCESS)

                except Exception as e:
                    # ---
                    # triger sendResponseCfn() to signal back to Cloudformation
                    # that something went wrong and point to Cloudwatch Logs.
                    # ---
                    logger.info("Exception: {}".format(e))
                    sendResponseCfn(event, context, cfnresponse.FAILED)

            def sendResponseCfn(event, context, responseStatus):
                responseData = {}
                responseData['Data'] = {}
                cfnresponse.send(event, context, responseStatus, responseData, "CustomResourcePhysicalID")

      Description: This function will empty the Amazon S3 Bucket "S3Bucket" upon stack deletion.
      Handler: "index.lambda_handler"
      Runtime: python3.12
      MemorySize: 128
      Timeout: 60
      Role: !GetAtt BucketJanitorRole.Arn
      # Tagging Ressources to leverage SSM's Application Manager.
      # ---
      Tags:
        - Key: AppManagerCFNStackKey
          Value: !Ref 'AWS::StackId'

  # AWS Lambda Execution Role
  # ---
  BucketJanitorRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Version: "2012-10-17"
        Statement:
          -
            Effect: Allow
            Principal:
              Service: lambda.amazonaws.com
            Action: sts:AssumeRole
      Path: "/"
      ManagedPolicyArns:
        - "arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole"
      # Tagging Ressources to leverage SSM's Application Manager.
      # ---
      Tags:
        - Key: AppManagerCFNStackKey
          Value: !Ref 'AWS::StackId'

  # Amazon SageMaker Execution Role
  # ---
  SageMakerIamRole:
    Type: "AWS::IAM::Role"
    Properties:
      AssumeRolePolicyDocument:
        Version: "2012-10-17"
        Statement:
          -
            Effect: Allow
            Principal:
              Service: sagemaker.amazonaws.com
            Action: sts:AssumeRole
      Path: "/"
      Policies:
        - PolicyName: InlinePolicies
          PolicyDocument:
            Version: 2012-10-17
            Statement:
              - Effect: Allow
                Action:
                  - iam:CreateRole
                  - logs:PutLogEvents
                Resource:
                  - !Sub 'arn:aws:logs:${AWS::Region}:${AWS::AccountId}:log-group:/aws/lambda/RetailDemoStorePersonalizePreCreateResources:log-stream:*'
                  - !Sub 'arn:aws:logs:${AWS::Region}:${AWS::AccountId}:log-group:/aws/lambda/RetailDemoStorePersonalizePreCreateResources'
      ManagedPolicyArns:
        - "arn:aws:iam::aws:policy/AmazonSageMakerFullAccess"
        - "arn:aws:iam::aws:policy/service-role/AmazonPersonalizeFullAccess"
        - "arn:aws:iam::aws:policy/AmazonSSMReadOnlyAccess"
      # Tagging Ressources to leverage SSM's Application Manager.
      # ---
      Tags:
        - Key: AppManagerCFNStackKey
          Value: !Ref 'AWS::StackId'

  # Amazon Personalize Execution Role
  # ---
  PersonalizeIamRole:
    Type: "AWS::IAM::Role"
    Properties:
      AssumeRolePolicyDocument:
        Version: '2012-10-17'
        Statement:
          -
            Effect: Allow
            Principal:
              Service: personalize.amazonaws.com
            Action: sts:AssumeRole
      Path: "/"
      ManagedPolicyArns:
        - "arn:aws:iam::aws:policy/service-role/AmazonPersonalizeFullAccess"
        - "arn:aws:iam::aws:policy/AmazonSSMReadOnlyAccess"
      # Tagging Ressources to leverage SSM's Application Manager.
      # ---
      Tags:
        - Key: AppManagerCFNStackKey
          Value: !Ref 'AWS::StackId'

  # AWS Identity and Access Management - S3 Custom Access Policy
  # ---
  # This policy allows Sagemaker and Personalize to perform any actions on the
  # S3 bucket created by this template
  AmazonS3BucketAccessPolicy:
      Type: AWS::IAM::ManagedPolicy
      Properties:
        PolicyDocument:
          Version: '2012-10-17'
          Statement:
            -
              Effect: Allow
              Action:
                - "s3:*"
              Resource:
                - !Sub arn:aws:s3:::${S3Bucket}
                - !Sub arn:aws:s3:::${S3Bucket}/*
        Roles:
          - !Ref SageMakerIamRole
          - !Ref PersonalizeIamRole
          - !Ref BucketJanitorRole

  # Amazon S3 - S3 Bucket Policy
  # ---
  # This policy allows Personalize to perform any actions on the
  # S3 bucket created by this template
  PersonalizeBucketPolicy:
    Type: AWS::S3::BucketPolicy
    Properties:
      Bucket: !Ref S3Bucket
      PolicyDocument:
        Version: '2012-10-17'
        Id: 'PersonalizeS3BucketAccessPolicy'
        Statement:
          - Action:
              - 's3:GetObject'
              - 's3:PutObject'
              - 's3:ListBucket'
            Effect: Allow
            Resource:
              - !Sub arn:aws:s3:::${S3Bucket}
              - !Sub arn:aws:s3:::${S3Bucket}/*
            Principal:
              Service: personalize.amazonaws.com

  # SageMaker notebook
  # ---
  NotebookInstance:
    Type: "AWS::SageMaker::NotebookInstance"
    Properties:
      # bumped ml.t2.medium to ml.t3.medium for newer regions compatibility
      InstanceType: "ml.t3.medium"
      NotebookInstanceName: !Ref NotebookName
      RoleArn: !GetAtt SageMakerIamRole.Arn
      VolumeSizeInGB: !Ref VolumeSize
      DefaultCodeRepository: https://github.com/aws-samples/amazon-personalize-samples.git
      Tags:
        - Key: AppManagerCFNStackKey
          Value: !Ref 'AWS::StackId'

  # SSM Parameter with the s3 bucket for personalize
  # ---
  PersonalizeS3Bucket:
    Type: AWS::SSM::Parameter
    Properties:
      Name: /cloudformation/personalize-s3-bucket
      Type: String
      Value: !Ref BucketName
      Description: SSM Parameter containing the s3 bucket for Personalize Samples.
      # Tagging Ressources to leverage SSM's Application Manager.
      # ---
      Tags:
        Key: AppManagerCFNStackKey
        Value: !Ref 'AWS::StackId'

  # SSM Parameter with the IAM Role for personalize
  # ---
  PersonalizeIAMRole:
    Type: AWS::SSM::Parameter
    Properties:
      Name: /cloudformation/personalize-iam-role-arn
      Type: String
      Value: !GetAtt PersonalizeIamRole.Arn
      Description: SSM Parameter containing the iam role arn for Personalize.
      # Tagging Ressources to leverage SSM's Application Manager.
      # ---
      Tags:
        Key: AppManagerCFNStackKey
        Value: !Ref 'AWS::StackId'

Outputs:
  S3Bucket:
    Value: !Ref BucketName
    Description: S3 Bucket for object storage
  NotebookInstance:
    Value: !Ref NotebookInstance
    Description: SageMaker Notebook Instance
  AppManagerUrl:
    Value: !Sub "https://console.aws.amazon.com/systems-manager/appmanager/application/AppManager-CFN-${AWS::StackName}"
    Description: AWS Systems Manager Application Manager for this stack