# yaml-language-server: $schema=../../../schemas/@aws-mdaa/sagemaker-mlops.json
# MLOps Pipeline Configuration
#
# Unified config for the full train → deploy → monitor lifecycle.
# A single `mdaa deploy` creates both the training and deployment CI/CD pipelines.
# The deploy pipeline's seed code handles endpoint creation and model monitoring.

# ── Training pipeline ──────────────────────────────────────────────────────
# What it creates:
#   - Model Package Group (versioned model registry)
#   - S3 bucket for model artifacts (KMS encrypted)
#   - CodeCommit repository seeded with ML pipeline code
#   - CodePipeline (Source → Build) that runs the seed code on every push
#
# The seed code deploys a SageMaker Pipeline (preprocess → train → register)
# and starts an execution. When the model is registered as "Approved",
# EventBridge triggers the deployment pipeline below.
training:
  projectName: "{{context:sagemaker_project_name}}"

  # Path to the training seed code (ML scripts, buildspec, MDAA pipeline config)
  seedCodePath: "../seed_code/training"

  # Path to local training data directory. Files here are uploaded to the pipeline
  # S3 bucket (s3://<pipeline-bucket>/dataset/) during mdaa deploy.
  trainingDataPath: "../data"

  # Network isolation: prevents training containers from making outbound network calls.
  # Set to true for compliance; set to false if training code needs to download packages at runtime.
  enableNetworkIsolation: true

  # Encrypt traffic between containers in distributed training jobs (e.g., multi-instance XGBoost).
  enableInterContainerEncryption: true

  # SageMaker Studio domain integration (optional — enables SageMaker project tracking)
  # domainId: "ssm-org:/shared/studio/domain-id"
  # domainArn: "ssm-org:/shared/studio/domain-arn"

  # Source repository type (optional — default: CODECOMMIT)
  # Switch to CODESTAR_CONNECTIONS to use an existing GitHub/GitLab/Bitbucket repo
  # instead of auto-creating a CodeCommit repo.
  # sourceType: CODESTAR_CONNECTIONS
  # codeStarConnection:
  #   connectionArn: "<connection-arn>"
  #   owner: "<github-owner>"
  #   repo: "<repo-name>"
  #   branch: main

  # VPC config for training/processing jobs — runs SageMaker jobs inside your VPC
  devEnvironment:
    vpcId: "{{context:vpc_id}}"
    subnetIds: "{{context:subnet_ids}}"
    securityGroupIds: "{{context:security_group_ids}}"

  # Cross-account model registry access (optional)
  # Grants pre-prod/prod accounts permission to read model packages and model artifacts
  # for cross-account endpoint deployment.
  # preProdAccountId: "<pre-prod-account-id>"
  # prodAccountId: "<prod-account-id>"

  # (Optional) Additional IAM policies for the build role.
  # Use this to grant the build environment access to private registries
  # (CodeArtifact, ECR), secrets, or other AWS services needed by the buildspec.
  # Supports policyArn (reference existing) or policyDocument (inline statements).
  #
  # Example: CodeArtifact read access for private npm registry
  # buildPolicies:
  #   - policyDocument:
  #       Statement:
  #         - Effect: Allow
  #           Action: codeartifact:GetAuthorizationToken
  #           Resource: "arn:{{partition}}:codeartifact:{{region}}:{{account}}:domain/<domain>"
  #         - Effect: Allow
  #           Action:
  #             - codeartifact:GetRepositoryEndpoint
  #             - codeartifact:ReadFromRepository
  #           Resource: "arn:{{partition}}:codeartifact:{{region}}:{{account}}:repository/<domain>/<repo>"
  #         - Effect: Allow
  #           Action: sts:GetServiceBearerToken
  #           Resource: "*"
  #           Condition:
  #             StringEquals:
  #               "sts:AWSServiceName": codeartifact.amazonaws.com
  #     suppressions:
  #       - id: AwsSolutions-IAM5
  #         reason: "sts:GetServiceBearerToken requires Resource:* conditioned on sts:AWSServiceName=codeartifact.amazonaws.com"

# ── Deployment pipeline ────────────────────────────────────────────────────
# What it creates:
#   - CodeCommit repository seeded with endpoint + monitoring MDAA configs
#   - CodePipeline with per-stage deployment:
#       Source → DeployDev → [ManualApproval] → DeployPreProd → [ManualApproval] → DeployProd
#   - EventBridge rule: auto-triggers the pipeline when a model is approved in the registry
#
# Each stage deploys:
#   1. SageMaker Endpoint (real-time inference) via @aws-mdaa/sagemaker-endpoint
#   2. Model Monitoring schedule (model quality) via @aws-mdaa/sagemaker-model-monitoring
deploy:
  projectName: "{{context:sagemaker_project_name}}"

  # modelPackageGroupName and modelBucketName are auto-wired from the training construct above.
  # No SSM references needed when using the unified mlops-app.

  # Path to the deployment seed code (MDAA endpoint + monitoring configs, buildspec)
  seedCodePath: "../seed_code/deploy"

  # Source repository type (optional — default: CODECOMMIT)
  # Must match the training sourceType if switching to CODESTAR_CONNECTIONS.
  # sourceType: CODESTAR_CONNECTIONS
  # codeStarConnection:
  #   connectionArn: "<connection-arn>"
  #   owner: "<github-owner>"
  #   repo: "<repo-name>"
  #   branch: main

  # Manual approval gates between stages (dev → preprod → prod).
  # When true, the pipeline pauses at ApprovePreProd and ApproveProd stages,
  # requiring an operator to approve in the CodePipeline console before proceeding.
  enableManualApproval: true

  # EventBridge trigger: automatically starts the deploy pipeline when a model
  # in the registry transitions to "Approved" status. Disable if you want to
  # trigger deployments manually (e.g., via CodePipeline console or API).
  enableEventBridgeTrigger: true

  # Data capture: records a sample of endpoint request/response payloads to S3.
  # Required for model monitoring — the monitoring schedule reads captured data
  # to detect data drift and model quality degradation. Disable only if you are
  # not using model monitoring.
  enableDataCapture: true

  # Network isolation for the endpoint: restricts the model container from making
  # outbound network calls. Recommended for compliance; the model only needs access
  # to S3 (model artifacts) and CloudWatch (metrics), both available via VPC endpoints.
  enableNetworkIsolation: true

  # VPC config for the endpoint and monitoring jobs
  devEnvironment:
    vpcId: "{{context:vpc_id}}"
    subnetIds: "{{context:subnet_ids}}"
    securityGroupIds: "{{context:security_group_ids}}"

  # (Optional) Additional IAM policies for the build roles.
  # Use this to grant the build environment access to private registries
  # (CodeArtifact, ECR), secrets, or other AWS services needed by the buildspec.
  # Supports policyArn (reference existing) or policyDocument (inline statements).
  #
  # Example: CodeArtifact read access for private npm registry
  # buildPolicies:
  #   - policyDocument:
  #       Statement:
  #         - Effect: Allow
  #           Action: codeartifact:GetAuthorizationToken
  #           Resource: "arn:{{partition}}:codeartifact:{{region}}:{{account}}:domain/<domain>"
  #         - Effect: Allow
  #           Action:
  #             - codeartifact:GetRepositoryEndpoint
  #             - codeartifact:ReadFromRepository
  #           Resource: "arn:{{partition}}:codeartifact:{{region}}:{{account}}:repository/<domain>/<repo>"
  #         - Effect: Allow
  #           Action: sts:GetServiceBearerToken
  #           Resource: "*"
  #           Condition:
  #             StringEquals:
  #               "sts:AWSServiceName": codeartifact.amazonaws.com
  #     suppressions:
  #       - id: AwsSolutions-IAM5
  #         reason: "sts:GetServiceBearerToken requires Resource:* conditioned on sts:AWSServiceName=codeartifact.amazonaws.com"

  # Cross-account deployment (optional)
  # When configured, the deploy pipeline adds PreProd and Prod stages.
  # Each stage deploys the endpoint + monitoring to the target account.
  # Requires CDK bootstrap with cross-account trust in the target account.
  # preProdEnvironment:
  #   accountId: "{{context:preprod_account_id}}"
  #   region: "{{context:preprod_region}}"
  #   vpcId: "{{context:preprod_vpc_id}}"
  #   subnetIds: "{{context:preprod_subnet_ids}}"
  #   securityGroupIds: "{{context:preprod_security_group_ids}}"
  # prodEnvironment:
  #   accountId: "{{context:prod_account_id}}"
  #   region: "{{context:prod_region}}"
  #   vpcId: "{{context:prod_vpc_id}}"
  #   subnetIds: "{{context:prod_subnet_ids}}"
  #   securityGroupIds: "{{context:prod_security_group_ids}}"