2021/03/19 - Amazon SageMaker Service - 2 updated api methods
Changes Adding authentication support for pulling images stored in private Docker registries to build containers for real-time inference.
{'Containers': {'ImageConfig': {'RepositoryAuthConfig': {'RepositoryCredentialsProviderArn': 'string'}}},
'PrimaryContainer': {'ImageConfig': {'RepositoryAuthConfig': {'RepositoryCredentialsProviderArn': 'string'}}}}
Creates a model in Amazon SageMaker. In the request, you name the model and describe a primary container. For the primary container, you specify the Docker image that contains inference code, artifacts (from prior training), and a custom environment map that the inference code uses when you deploy the model for predictions.
Use this API to create a model if you want to use Amazon SageMaker hosting services or run a batch transform job.
To host your model, you create an endpoint configuration with the CreateEndpointConfig API, and then create an endpoint with the CreateEndpoint API. Amazon SageMaker then deploys all of the containers that you defined for the model in the hosting environment.
For an example that calls this method when deploying a model to Amazon SageMaker hosting services, see Deploy the Model to Amazon SageMaker Hosting Services (AWS SDK for Python (Boto 3)).
To run a batch transform using your model, you start a job with the CreateTransformJob API. Amazon SageMaker uses your model and your dataset to get inferences which are then saved to a specified S3 location.
In the CreateModel request, you must define a container with the PrimaryContainer parameter.
In the request, you also provide an IAM role that Amazon SageMaker can assume to access model artifacts and docker image for deployment on ML compute hosting instances or for batch transform jobs. In addition, you also use the IAM role to manage permissions the inference code needs. For example, if the inference code access any other AWS resources, you grant necessary permissions via this role.
See also: AWS API Documentation
Request Syntax
client.create_model(
ModelName='string',
PrimaryContainer={
'ContainerHostname': 'string',
'Image': 'string',
'ImageConfig': {
'RepositoryAccessMode': 'Platform'|'Vpc',
'RepositoryAuthConfig': {
'RepositoryCredentialsProviderArn': 'string'
}
},
'Mode': 'SingleModel'|'MultiModel',
'ModelDataUrl': 'string',
'Environment': {
'string': 'string'
},
'ModelPackageName': 'string',
'MultiModelConfig': {
'ModelCacheSetting': 'Enabled'|'Disabled'
}
},
Containers=[
{
'ContainerHostname': 'string',
'Image': 'string',
'ImageConfig': {
'RepositoryAccessMode': 'Platform'|'Vpc',
'RepositoryAuthConfig': {
'RepositoryCredentialsProviderArn': 'string'
}
},
'Mode': 'SingleModel'|'MultiModel',
'ModelDataUrl': 'string',
'Environment': {
'string': 'string'
},
'ModelPackageName': 'string',
'MultiModelConfig': {
'ModelCacheSetting': 'Enabled'|'Disabled'
}
},
],
InferenceExecutionConfig={
'Mode': 'Serial'|'Direct'
},
ExecutionRoleArn='string',
Tags=[
{
'Key': 'string',
'Value': 'string'
},
],
VpcConfig={
'SecurityGroupIds': [
'string',
],
'Subnets': [
'string',
]
},
EnableNetworkIsolation=True|False
)
string
[REQUIRED]
The name of the new model.
dict
The location of the primary docker image containing inference code, associated artifacts, and custom environment map that the inference code uses when the model is deployed for predictions.
ContainerHostname (string) --
This parameter is ignored for models that contain only a PrimaryContainer .
When a ContainerDefinition is part of an inference pipeline, the value of the parameter uniquely identifies the container for the purposes of logging and metrics. For information, see Use Logs and Metrics to Monitor an Inference Pipeline . If you don't specify a value for this parameter for a ContainerDefinition that is part of an inference pipeline, a unique name is automatically assigned based on the position of the ContainerDefinition in the pipeline. If you specify a value for the ContainerHostName for any ContainerDefinition that is part of an inference pipeline, you must specify a value for the ContainerHostName parameter of every ContainerDefinition in that pipeline.
Image (string) --
The path where inference code is stored. This can be either in Amazon EC2 Container Registry or in a Docker registry that is accessible from the same VPC that you configure for your endpoint. If you are using your own custom algorithm instead of an algorithm provided by Amazon SageMaker, the inference code must meet Amazon SageMaker requirements. Amazon SageMaker supports both registry/repository[:tag] and registry/repository[@digest] image path formats. For more information, see Using Your Own Algorithms with Amazon SageMaker
ImageConfig (dict) --
Specifies whether the model container is in Amazon ECR or a private Docker registry accessible from your Amazon Virtual Private Cloud (VPC). For information about storing containers in a private Docker registry, see Use a Private Docker Registry for Real-Time Inference Containers
RepositoryAccessMode (string) -- [REQUIRED]
Set this to one of the following values:
Platform - The model image is hosted in Amazon ECR.
Vpc - The model image is hosted in a private Docker registry in your VPC.
RepositoryAuthConfig (dict) --
(Optional) Specifies an authentication configuration for the private docker registry where your model image is hosted. Specify a value for this property only if you specified Vpc as the value for the RepositoryAccessMode field, and the private Docker registry where the model image is hosted requires authentication.
RepositoryCredentialsProviderArn (string) -- [REQUIRED]
The Amazon Resource Name (ARN) of an AWS Lambda function that provides credentials to authenticate to the private Docker registry where your model image is hosted. For information about how to create an AWS Lambda function, see Create a Lambda function with the console in the AWS Lambda Developer Guide .
Mode (string) --
Whether the container hosts a single model or multiple models.
ModelDataUrl (string) --
The S3 path where the model artifacts, which result from model training, are stored. This path must point to a single gzip compressed tar archive (.tar.gz suffix). The S3 path is required for Amazon SageMaker built-in algorithms, but not if you use your own algorithms. For more information on built-in algorithms, see Common Parameters .
Note
The model artifacts must be in an S3 bucket that is in the same region as the model or endpoint you are creating.
If you provide a value for this parameter, Amazon SageMaker uses AWS Security Token Service to download model artifacts from the S3 path you provide. AWS STS is activated in your IAM user account by default. If you previously deactivated AWS STS for a region, you need to reactivate AWS STS for that region. For more information, see Activating and Deactivating AWS STS in an AWS Region in the AWS Identity and Access Management User Guide .
Warning
If you use a built-in algorithm to create a model, Amazon SageMaker requires that you provide a S3 path to the model artifacts in ModelDataUrl .
Environment (dict) --
The environment variables to set in the Docker container. Each key and value in the Environment string to string map can have length of up to 1024. We support up to 16 entries in the map.
(string) --
(string) --
ModelPackageName (string) --
The name or Amazon Resource Name (ARN) of the model package to use to create the model.
MultiModelConfig (dict) --
Specifies additional configuration for multi-model endpoints.
ModelCacheSetting (string) --
Whether to cache models for a multi-model endpoint. By default, multi-model endpoints cache models so that a model does not have to be loaded into memory each time it is invoked. Some use cases do not benefit from model caching. For example, if an endpoint hosts a large number of models that are each invoked infrequently, the endpoint might perform better if you disable model caching. To disable model caching, set the value of this parameter to Disabled .
list
Specifies the containers in the inference pipeline.
(dict) --
Describes the container, as part of model definition.
ContainerHostname (string) --
This parameter is ignored for models that contain only a PrimaryContainer .
When a ContainerDefinition is part of an inference pipeline, the value of the parameter uniquely identifies the container for the purposes of logging and metrics. For information, see Use Logs and Metrics to Monitor an Inference Pipeline . If you don't specify a value for this parameter for a ContainerDefinition that is part of an inference pipeline, a unique name is automatically assigned based on the position of the ContainerDefinition in the pipeline. If you specify a value for the ContainerHostName for any ContainerDefinition that is part of an inference pipeline, you must specify a value for the ContainerHostName parameter of every ContainerDefinition in that pipeline.
Image (string) --
The path where inference code is stored. This can be either in Amazon EC2 Container Registry or in a Docker registry that is accessible from the same VPC that you configure for your endpoint. If you are using your own custom algorithm instead of an algorithm provided by Amazon SageMaker, the inference code must meet Amazon SageMaker requirements. Amazon SageMaker supports both registry/repository[:tag] and registry/repository[@digest] image path formats. For more information, see Using Your Own Algorithms with Amazon SageMaker
ImageConfig (dict) --
Specifies whether the model container is in Amazon ECR or a private Docker registry accessible from your Amazon Virtual Private Cloud (VPC). For information about storing containers in a private Docker registry, see Use a Private Docker Registry for Real-Time Inference Containers
RepositoryAccessMode (string) -- [REQUIRED]
Set this to one of the following values:
Platform - The model image is hosted in Amazon ECR.
Vpc - The model image is hosted in a private Docker registry in your VPC.
RepositoryAuthConfig (dict) --
(Optional) Specifies an authentication configuration for the private docker registry where your model image is hosted. Specify a value for this property only if you specified Vpc as the value for the RepositoryAccessMode field, and the private Docker registry where the model image is hosted requires authentication.
RepositoryCredentialsProviderArn (string) -- [REQUIRED]
The Amazon Resource Name (ARN) of an AWS Lambda function that provides credentials to authenticate to the private Docker registry where your model image is hosted. For information about how to create an AWS Lambda function, see Create a Lambda function with the console in the AWS Lambda Developer Guide .
Mode (string) --
Whether the container hosts a single model or multiple models.
ModelDataUrl (string) --
The S3 path where the model artifacts, which result from model training, are stored. This path must point to a single gzip compressed tar archive (.tar.gz suffix). The S3 path is required for Amazon SageMaker built-in algorithms, but not if you use your own algorithms. For more information on built-in algorithms, see Common Parameters .
Note
The model artifacts must be in an S3 bucket that is in the same region as the model or endpoint you are creating.
If you provide a value for this parameter, Amazon SageMaker uses AWS Security Token Service to download model artifacts from the S3 path you provide. AWS STS is activated in your IAM user account by default. If you previously deactivated AWS STS for a region, you need to reactivate AWS STS for that region. For more information, see Activating and Deactivating AWS STS in an AWS Region in the AWS Identity and Access Management User Guide .
Warning
If you use a built-in algorithm to create a model, Amazon SageMaker requires that you provide a S3 path to the model artifacts in ModelDataUrl .
Environment (dict) --
The environment variables to set in the Docker container. Each key and value in the Environment string to string map can have length of up to 1024. We support up to 16 entries in the map.
(string) --
(string) --
ModelPackageName (string) --
The name or Amazon Resource Name (ARN) of the model package to use to create the model.
MultiModelConfig (dict) --
Specifies additional configuration for multi-model endpoints.
ModelCacheSetting (string) --
Whether to cache models for a multi-model endpoint. By default, multi-model endpoints cache models so that a model does not have to be loaded into memory each time it is invoked. Some use cases do not benefit from model caching. For example, if an endpoint hosts a large number of models that are each invoked infrequently, the endpoint might perform better if you disable model caching. To disable model caching, set the value of this parameter to Disabled .
dict
Specifies details of how containers in a multi-container endpoint are called.
Mode (string) -- [REQUIRED]
How containers in a multi-container are run. The following values are valid.
SERIAL - Containers run as a serial pipeline.
DIRECT - Only the individual container that you specify is run.
string
[REQUIRED]
The Amazon Resource Name (ARN) of the IAM role that Amazon SageMaker can assume to access model artifacts and docker image for deployment on ML compute instances or for batch transform jobs. Deploying on ML compute instances is part of model hosting. For more information, see Amazon SageMaker Roles .
Note
To be able to pass this role to Amazon SageMaker, the caller of this API must have the iam:PassRole permission.
list
An array of key-value pairs. You can use tags to categorize your AWS resources in different ways, for example, by purpose, owner, or environment. For more information, see Tagging AWS Resources .
(dict) --
Describes a tag.
Key (string) -- [REQUIRED]
The tag key.
Value (string) -- [REQUIRED]
The tag value.
dict
A VpcConfig object that specifies the VPC that you want your model to connect to. Control access to and from your model container by configuring the VPC. VpcConfig is used in hosting services and in batch transform. For more information, see Protect Endpoints by Using an Amazon Virtual Private Cloud and Protect Data in Batch Transform Jobs by Using an Amazon Virtual Private Cloud .
SecurityGroupIds (list) -- [REQUIRED]
The VPC security group IDs, in the form sg-xxxxxxxx. Specify the security groups for the VPC that is specified in the Subnets field.
(string) --
Subnets (list) -- [REQUIRED]
The ID of the subnets in the VPC to which you want to connect your training job or model. For information about the availability of specific instance types, see Supported Instance Types and Availability Zones .
(string) --
boolean
Isolates the model container. No inbound or outbound network calls can be made to or from the model container.
dict
Response Syntax
{
'ModelArn': 'string'
}
Response Structure
(dict) --
ModelArn (string) --
The ARN of the model created in Amazon SageMaker.
{'Containers': {'ImageConfig': {'RepositoryAuthConfig': {'RepositoryCredentialsProviderArn': 'string'}}},
'PrimaryContainer': {'ImageConfig': {'RepositoryAuthConfig': {'RepositoryCredentialsProviderArn': 'string'}}}}
Describes a model that you created using the CreateModel API.
See also: AWS API Documentation
Request Syntax
client.describe_model(
ModelName='string'
)
string
[REQUIRED]
The name of the model.
dict
Response Syntax
{
'ModelName': 'string',
'PrimaryContainer': {
'ContainerHostname': 'string',
'Image': 'string',
'ImageConfig': {
'RepositoryAccessMode': 'Platform'|'Vpc',
'RepositoryAuthConfig': {
'RepositoryCredentialsProviderArn': 'string'
}
},
'Mode': 'SingleModel'|'MultiModel',
'ModelDataUrl': 'string',
'Environment': {
'string': 'string'
},
'ModelPackageName': 'string',
'MultiModelConfig': {
'ModelCacheSetting': 'Enabled'|'Disabled'
}
},
'Containers': [
{
'ContainerHostname': 'string',
'Image': 'string',
'ImageConfig': {
'RepositoryAccessMode': 'Platform'|'Vpc',
'RepositoryAuthConfig': {
'RepositoryCredentialsProviderArn': 'string'
}
},
'Mode': 'SingleModel'|'MultiModel',
'ModelDataUrl': 'string',
'Environment': {
'string': 'string'
},
'ModelPackageName': 'string',
'MultiModelConfig': {
'ModelCacheSetting': 'Enabled'|'Disabled'
}
},
],
'InferenceExecutionConfig': {
'Mode': 'Serial'|'Direct'
},
'ExecutionRoleArn': 'string',
'VpcConfig': {
'SecurityGroupIds': [
'string',
],
'Subnets': [
'string',
]
},
'CreationTime': datetime(2015, 1, 1),
'ModelArn': 'string',
'EnableNetworkIsolation': True|False
}
Response Structure
(dict) --
ModelName (string) --
Name of the Amazon SageMaker model.
PrimaryContainer (dict) --
The location of the primary inference code, associated artifacts, and custom environment map that the inference code uses when it is deployed in production.
ContainerHostname (string) --
This parameter is ignored for models that contain only a PrimaryContainer .
When a ContainerDefinition is part of an inference pipeline, the value of the parameter uniquely identifies the container for the purposes of logging and metrics. For information, see Use Logs and Metrics to Monitor an Inference Pipeline . If you don't specify a value for this parameter for a ContainerDefinition that is part of an inference pipeline, a unique name is automatically assigned based on the position of the ContainerDefinition in the pipeline. If you specify a value for the ContainerHostName for any ContainerDefinition that is part of an inference pipeline, you must specify a value for the ContainerHostName parameter of every ContainerDefinition in that pipeline.
Image (string) --
The path where inference code is stored. This can be either in Amazon EC2 Container Registry or in a Docker registry that is accessible from the same VPC that you configure for your endpoint. If you are using your own custom algorithm instead of an algorithm provided by Amazon SageMaker, the inference code must meet Amazon SageMaker requirements. Amazon SageMaker supports both registry/repository[:tag] and registry/repository[@digest] image path formats. For more information, see Using Your Own Algorithms with Amazon SageMaker
ImageConfig (dict) --
Specifies whether the model container is in Amazon ECR or a private Docker registry accessible from your Amazon Virtual Private Cloud (VPC). For information about storing containers in a private Docker registry, see Use a Private Docker Registry for Real-Time Inference Containers
RepositoryAccessMode (string) --
Set this to one of the following values:
Platform - The model image is hosted in Amazon ECR.
Vpc - The model image is hosted in a private Docker registry in your VPC.
RepositoryAuthConfig (dict) --
(Optional) Specifies an authentication configuration for the private docker registry where your model image is hosted. Specify a value for this property only if you specified Vpc as the value for the RepositoryAccessMode field, and the private Docker registry where the model image is hosted requires authentication.
RepositoryCredentialsProviderArn (string) --
The Amazon Resource Name (ARN) of an AWS Lambda function that provides credentials to authenticate to the private Docker registry where your model image is hosted. For information about how to create an AWS Lambda function, see Create a Lambda function with the console in the AWS Lambda Developer Guide .
Mode (string) --
Whether the container hosts a single model or multiple models.
ModelDataUrl (string) --
The S3 path where the model artifacts, which result from model training, are stored. This path must point to a single gzip compressed tar archive (.tar.gz suffix). The S3 path is required for Amazon SageMaker built-in algorithms, but not if you use your own algorithms. For more information on built-in algorithms, see Common Parameters .
Note
The model artifacts must be in an S3 bucket that is in the same region as the model or endpoint you are creating.
If you provide a value for this parameter, Amazon SageMaker uses AWS Security Token Service to download model artifacts from the S3 path you provide. AWS STS is activated in your IAM user account by default. If you previously deactivated AWS STS for a region, you need to reactivate AWS STS for that region. For more information, see Activating and Deactivating AWS STS in an AWS Region in the AWS Identity and Access Management User Guide .
Warning
If you use a built-in algorithm to create a model, Amazon SageMaker requires that you provide a S3 path to the model artifacts in ModelDataUrl .
Environment (dict) --
The environment variables to set in the Docker container. Each key and value in the Environment string to string map can have length of up to 1024. We support up to 16 entries in the map.
(string) --
(string) --
ModelPackageName (string) --
The name or Amazon Resource Name (ARN) of the model package to use to create the model.
MultiModelConfig (dict) --
Specifies additional configuration for multi-model endpoints.
ModelCacheSetting (string) --
Whether to cache models for a multi-model endpoint. By default, multi-model endpoints cache models so that a model does not have to be loaded into memory each time it is invoked. Some use cases do not benefit from model caching. For example, if an endpoint hosts a large number of models that are each invoked infrequently, the endpoint might perform better if you disable model caching. To disable model caching, set the value of this parameter to Disabled .
Containers (list) --
The containers in the inference pipeline.
(dict) --
Describes the container, as part of model definition.
ContainerHostname (string) --
This parameter is ignored for models that contain only a PrimaryContainer .
When a ContainerDefinition is part of an inference pipeline, the value of the parameter uniquely identifies the container for the purposes of logging and metrics. For information, see Use Logs and Metrics to Monitor an Inference Pipeline . If you don't specify a value for this parameter for a ContainerDefinition that is part of an inference pipeline, a unique name is automatically assigned based on the position of the ContainerDefinition in the pipeline. If you specify a value for the ContainerHostName for any ContainerDefinition that is part of an inference pipeline, you must specify a value for the ContainerHostName parameter of every ContainerDefinition in that pipeline.
Image (string) --
The path where inference code is stored. This can be either in Amazon EC2 Container Registry or in a Docker registry that is accessible from the same VPC that you configure for your endpoint. If you are using your own custom algorithm instead of an algorithm provided by Amazon SageMaker, the inference code must meet Amazon SageMaker requirements. Amazon SageMaker supports both registry/repository[:tag] and registry/repository[@digest] image path formats. For more information, see Using Your Own Algorithms with Amazon SageMaker
ImageConfig (dict) --
Specifies whether the model container is in Amazon ECR or a private Docker registry accessible from your Amazon Virtual Private Cloud (VPC). For information about storing containers in a private Docker registry, see Use a Private Docker Registry for Real-Time Inference Containers
RepositoryAccessMode (string) --
Set this to one of the following values:
Platform - The model image is hosted in Amazon ECR.
Vpc - The model image is hosted in a private Docker registry in your VPC.
RepositoryAuthConfig (dict) --
(Optional) Specifies an authentication configuration for the private docker registry where your model image is hosted. Specify a value for this property only if you specified Vpc as the value for the RepositoryAccessMode field, and the private Docker registry where the model image is hosted requires authentication.
RepositoryCredentialsProviderArn (string) --
The Amazon Resource Name (ARN) of an AWS Lambda function that provides credentials to authenticate to the private Docker registry where your model image is hosted. For information about how to create an AWS Lambda function, see Create a Lambda function with the console in the AWS Lambda Developer Guide .
Mode (string) --
Whether the container hosts a single model or multiple models.
ModelDataUrl (string) --
The S3 path where the model artifacts, which result from model training, are stored. This path must point to a single gzip compressed tar archive (.tar.gz suffix). The S3 path is required for Amazon SageMaker built-in algorithms, but not if you use your own algorithms. For more information on built-in algorithms, see Common Parameters .
Note
The model artifacts must be in an S3 bucket that is in the same region as the model or endpoint you are creating.
If you provide a value for this parameter, Amazon SageMaker uses AWS Security Token Service to download model artifacts from the S3 path you provide. AWS STS is activated in your IAM user account by default. If you previously deactivated AWS STS for a region, you need to reactivate AWS STS for that region. For more information, see Activating and Deactivating AWS STS in an AWS Region in the AWS Identity and Access Management User Guide .
Warning
If you use a built-in algorithm to create a model, Amazon SageMaker requires that you provide a S3 path to the model artifacts in ModelDataUrl .
Environment (dict) --
The environment variables to set in the Docker container. Each key and value in the Environment string to string map can have length of up to 1024. We support up to 16 entries in the map.
(string) --
(string) --
ModelPackageName (string) --
The name or Amazon Resource Name (ARN) of the model package to use to create the model.
MultiModelConfig (dict) --
Specifies additional configuration for multi-model endpoints.
ModelCacheSetting (string) --
Whether to cache models for a multi-model endpoint. By default, multi-model endpoints cache models so that a model does not have to be loaded into memory each time it is invoked. Some use cases do not benefit from model caching. For example, if an endpoint hosts a large number of models that are each invoked infrequently, the endpoint might perform better if you disable model caching. To disable model caching, set the value of this parameter to Disabled .
InferenceExecutionConfig (dict) --
Specifies details of how containers in a multi-container endpoint are called.
Mode (string) --
How containers in a multi-container are run. The following values are valid.
SERIAL - Containers run as a serial pipeline.
DIRECT - Only the individual container that you specify is run.
ExecutionRoleArn (string) --
The Amazon Resource Name (ARN) of the IAM role that you specified for the model.
VpcConfig (dict) --
A VpcConfig object that specifies the VPC that this model has access to. For more information, see Protect Endpoints by Using an Amazon Virtual Private Cloud
SecurityGroupIds (list) --
The VPC security group IDs, in the form sg-xxxxxxxx. Specify the security groups for the VPC that is specified in the Subnets field.
(string) --
Subnets (list) --
The ID of the subnets in the VPC to which you want to connect your training job or model. For information about the availability of specific instance types, see Supported Instance Types and Availability Zones .
(string) --
CreationTime (datetime) --
A timestamp that shows when the model was created.
ModelArn (string) --
The Amazon Resource Name (ARN) of the model.
EnableNetworkIsolation (boolean) --
If True , no inbound or outbound network calls can be made to or from the model container.