Sagemaker劳动力与cognito

Question

我正在努力为sagemaker私人劳动力与私人认知建立一个平台

后: https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/sagemaker_workforce

it working fine

main.tf

resource "aws_sagemaker_workforce" "workforce" {
workforce_name = "workforce"
cognito_config {
client_id = aws_cognito_user_pool_client.congnito_client.id
user_pool = aws_cognito_user_pool_domain.domain.user_pool_id
}
}
resource "aws_cognito_user_pool" "user_pool" {
name = "sagemaker-cognito-userpool"
}
resource "aws_cognito_user_pool_client" "congnito_client" {
name            = "congnito-client"
generate_secret = true
user_pool_id    = aws_cognito_user_pool.user_pool.id
}
resource "aws_cognito_user_group" "user_group" {
name         = "user-group"
user_pool_id = aws_cognito_user_pool.user_pool.id
}
resource "aws_cognito_user_pool_domain" "domain" {
domain       = "sagemaker-user-pool-ocr-domain"
user_pool_id = aws_cognito_user_pool.user_pool.id
}
resource "aws_sagemaker_workteam" "workteam" {
workteam_name  = "worker-team"
workforce_name = aws_sagemaker_workforce.workforce.id
description    = "worker-team"
member_definition {
cognito_member_definition {
client_id  = aws_cognito_user_pool_client.congnito_client.id
user_pool  = aws_cognito_user_pool_domain.domain.user_pool_id
user_group = aws_cognito_user_group.user_group.id
}
}
}
resource "aws_sagemaker_human_task_ui" "template" {
human_task_ui_name = "human-task-ui-template"
ui_template {
content = file("${path.module}/sagemaker-human-task-ui-template.html")
}
}
resource "aws_sagemaker_flow_definition" "definition" {
flow_definition_name = "flow-definition"
role_arn             = var.aws_iam_role
human_loop_config {
human_task_ui_arn                     = aws_sagemaker_human_task_ui.template.arn
task_availability_lifetime_in_seconds = 1
task_count                            = 1
task_description                      = "Task description"
task_title                            = "Please review the Key Value Pairs in this document"
workteam_arn                          = aws_sagemaker_workteam.workteam.arn
}
output_config {
s3_output_path = "s3://${var.s3_output_path}"
}
}

它正在用回调url创建cognito用户池。这些回调url来自aws_sagemaker_workforce.workforce.subdomain并在cognito中自动设置也就是我想要的.

但是我也想设置配置在cognitouserpool像

allowed_oauth_flows = ["code", "implicit"]
allowed_oauth_scopes = ["email", "openid", "profile"]

现在当我添加以上两行时，我们需要添加callbackurl也是我不想要的。

我试着

allowed_oauth_flows = ["code", "implicit"]
allowed_oauth_scopes = ["email", "openid", "profile"]
callback_urls = [aws_sagemaker_workforce.workforce.subdomain]

给出错误:

Cycle: module.sagemaker.aws_cognito_user_pool_client.congnito_client, module.sagemaker.aws_sagemaker_workforce.workforce

因为这两个资源是相互依赖的，我想传递这两行，但它也迫使我添加回调url。

这里是最后的main.tf三个是失败的行

resource "aws_sagemaker_workforce" "workforce" {
workforce_name = "workforce"
cognito_config {
client_id = aws_cognito_user_pool_client.congnito_client.id
user_pool = aws_cognito_user_pool_domain.domain.user_pool_id
}
}
resource "aws_cognito_user_pool" "user_pool" {
name = "sagemaker-cognito-userpool"
}
resource "aws_cognito_user_pool_client" "congnito_client" {
name            = "congnito-client"
generate_secret = true
user_pool_id    = aws_cognito_user_pool.user_pool.id
explicit_auth_flows                  = ["ALLOW_REFRESH_TOKEN_AUTH", "ALLOW_USER_PASSWORD_AUTH", "ALLOW_CUSTOM_AUTH", "ALLOW_USER_SRP_AUTH"]
allowed_oauth_flows_user_pool_client = true
supported_identity_providers = ["COGNITO"]
allowed_oauth_flows = ["code", "implicit"]
allowed_oauth_scopes = ["email", "openid", "profile"]
callback_urls = [aws_sagemaker_workforce.workforce.subdomain]
}
resource "aws_cognito_user_group" "user_group" {
name         = "user-group"
user_pool_id = aws_cognito_user_pool.user_pool.id
}
resource "aws_cognito_user_pool_domain" "domain" {
domain       = "sagemaker-user-pool-ocr-domain"
user_pool_id = aws_cognito_user_pool.user_pool.id
}
resource "aws_sagemaker_workteam" "workteam" {
workteam_name  = "worker-team"
workforce_name = aws_sagemaker_workforce.workforce.id
description    = "worker-team"
member_definition {
cognito_member_definition {
client_id  = aws_cognito_user_pool_client.congnito_client.id
user_pool  = aws_cognito_user_pool_domain.domain.user_pool_id
user_group = aws_cognito_user_group.user_group.id
}
}
}
resource "aws_sagemaker_human_task_ui" "template" {
human_task_ui_name = "human-task-ui-template"
ui_template {
content = file("${path.module}/sagemaker-human-task-ui-template.html")
}
}
resource "aws_sagemaker_flow_definition" "definition" {
flow_definition_name = "flow-definition"
role_arn             = var.aws_iam_role
human_loop_config {
human_task_ui_arn                     = aws_sagemaker_human_task_ui.template.arn
task_availability_lifetime_in_seconds = 1
task_count                            = 1
task_description                      = "Task description"
task_title                            = "Please review the Key Value Pairs in this document"
workteam_arn                          = aws_sagemaker_workteam.workteam.arn
}
output_config {
s3_output_path = "s3://${var.s3_output_path}"
}
}

Answer 1

您不需要为劳动力指定回调URL。为了创建aws_cognito_user_pool_client资源，指定以下内容就足够了:

callback_urls = [
"https://${aws_cognito_user_pool_domain.domain>.cloudfront_distribution_arn}",
]

然后在您的劳动力定义中引用用户池客户机:

resource "aws_sagemaker_workforce" "..." {
workforce_name = "..."
cognito_config {
client_id = aws_cognito_user_pool_client.<client_name>.id
user_pool = aws_cognito_user_pool_domain.<domain_name>.user_pool_id
}
}

在应用地形配置后，可以通过运行aws cognito-idp describe-user-pool-client --user-pool-id <pool_id> --client-id <client_id>来证明回调url的存在:

"UserPoolClient": {
...
"CallbackURLs": [
"https://____.cloudfront.net",
"https://____.labeling.eu-central-1.sagemaker.aws/oauth2/idpresponse"
],
"LogoutURLs": [
"https://____.labeling.eu-central-1.sagemaker.aws/logout"
],

似乎terraform本身对劳动力创造没有任何特别的作用(参见https://github.com/hashicorp/terraform-provider-aws/blob/main/internal/service/sagemaker/workforce.go)。因此，回调url似乎是由AWS SageMaker自己添加的。

这意味着您必须指示terraform忽略aws_cognito_user_pool_client配置中那些属性的更改:

lifecycle {
ignore_changes = [
callback_urls, logout_urls
]
}