[Question] Relax bucket and role

[desinurch]

Hi, I am using customized SageMaker IAM role and bucket, would it be possible to relax both of these values?

For example:
python3 -m sagemaker_ssh_helper.deregister_old_instances_from_ssm --iam-role "ml-experiment-*.*"

[ivan-khvostishkov]

Hi, @desinurch . Thank you for this question. Changing the default bucket is not yet possible, but we can consider this issue as a feature request.

As for IAM role, I think it's already possible by using the native features of AWS CLI:

1/ Add a new profile to ~/.aws/config with your role as mentioned in the doc:

[default]
region = eu-west-1

[profile ssh]
region = eu-west-1
role_arn = arn:aws:iam::123456789012:role/ml-experiment-...
source_profile = default

2/ When calling the scripts, prepend the command with AWS_PROFILE env variable that is mentioned in the doc:

AWS_PROFILE=ssh python3 -m sagemaker_ssh_helper.deregister_old_instances_from_ssm

Of course, the new role that you want to use should allow the AssumeRole action for your current role and you might need to ask your AWS administrator to do that (it's not possible to switch into a random role). Read more about switching roles in the IAM doc.

Let me know if it helps with the second part of your question.

[desinurch]

Thank you for your answer! Sorry I think I was lacking in my description for the IAM Role, what I meant is the filtering process
in this line https://github.com/aws-samples/sagemaker-ssh-helper/blob/main/sagemaker_ssh_helper/deregister_old_instances_from_ssm.py#L64

Currently it is only filtering based on the default sagemaker role .*sagemaker.*
Would it be possible to receive an argument here to customise the filtered role?

[ivan-khvostishkov]

Hi, @desinurch . Now I got it. Thank you for the clarification.

I suggest to remove this line and filter completely. SSHOwner filter by tag should be enough.
Will it work for you?

[gilinachum]

@desinurch per your request, we've removed the role tag completely.
#9

[desinurch]

Thanks @ivan-khvostishkov and @gilinachum now the instance deregister works like a charm!

Is there any ETA for custom bucket? otherwise i could give it a try if you're open

[gilinachum]

Thanks! glad it's working for you.
You're welcome to submit a PR for a custom bucket!

[ivan-khvostishkov]

@desinurch The custom bucket is under testing already. I will publish it on GitHub shortly, ETA is tomorrow.

[ivan-khvostishkov]

Hi, @desinurch,

Would you like to try the custom bucket feature from the main branch?
Use this command to install the dev version of library:

pip install 'git+https://github.com/aws-samples/sagemaker-ssh-helper.git'

I've added the FAQ for the feature ("How can I change the SSH authorized keys bucket and location when running sm-local-ssh-* commands?")

I plan to create a new release version shortly.

[desinurch]

perfect it works! thanks for the quick update

[ivan-khvostishkov]

You're welcome! The changes now are in the release v1.9.0.