Skip to content

Commit 9bfbbd3

Browse files
BassemHalimBassemHalim
committed
update example notebooks and fix minor bug
1 parent a8da82f commit 9bfbbd3

File tree

3 files changed

+41
-35
lines changed

3 files changed

+41
-35
lines changed

‎sagemaker-mlops/src/sagemaker/mlops/feature_store/feature_group_manager.py‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -613,12 +613,12 @@ def enable_lake_formation(
613613
"Lake Formation permissions were not granted to the "
614614
"execution role. Re-run enable_lake_formation() after fixing the issue."
615615
)
616-
if results["hybrid_access_mode_enabled"]:
616+
if not hybrid_access_mode_enabled and results["hybrid_access_mode_enabled"]:
617617
logger.warning(
618-
"Hybrid access mode is still enabled. IAM-based access "
618+
"Failed to disable hybrid access mode. IAM-based access "
619619
"to the Glue table is still allowed alongside Lake "
620-
"Formation permissions. To disable, re-run with "
621-
"hybrid_access_mode_enabled=False. For more info: "
620+
"Formation permissions. Re-run with "
621+
"hybrid_access_mode_enabled=False to retry. For more info: "
622622
"https://docs.aws.amazon.com/lake-formation/latest/dg/hybrid-access-mode.html"
623623
)
624624

‎v3-examples/ml-ops-examples/v3-feature-store-examples/v3-feature-store-lake-formation-cross-account.ipynb‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -222,7 +222,7 @@
222222
" enabled=True,\n",
223223
" use_service_linked_role=False,\n",
224224
" registration_role_arn=acc_to_role_arn[central_account],\n",
225-
" disable_hybrid_access_mode=True,\n",
225+
" hybrid_access_mode_enabled=False,\n",
226226
" acknowledge_risk=True # You acknowledge that IAM based access to the glue table will stop working\n",
227227
")\n",
228228
"\n",

‎v3-examples/ml-ops-examples/v3-feature-store-examples/v3-feature-store-lake-formation.ipynb‎

Lines changed: 36 additions & 30 deletions
Original file line numberDiff line numberDiff line change
@@ -25,13 +25,13 @@
2525
"lake_formation_config = LakeFormationConfig(\n",
2626
" enabled=True, # Enable Lake Formation governance\n",
2727
" use_service_linked_role=True, # Use LF service-linked role (default)\n",
28-
" registration_role_arn=None, # Role used by LF to access your resources\n",
29-
" disable_hybrid_access_mode # Revoke IAMAllowedPrincipal permissions (REQUIRED)\n",
30-
" acknowledge_risk # Controls confirmation behavior for risky Lake Formation operations.\n",
28+
" registration_role_arn=None, # Role used by LF to access your S3 bucket\n",
29+
" hybrid_access_mode_enabled # Keep or revoke IAMAllowedPrincipal permissions (REQUIRED)\n",
30+
" acknowledge_risk # Controls confirmation behavior for risky Lake Formation operations. (REQUIRED)\n",
3131
")\n",
3232
"```\n",
3333
"\n",
34-
"> **Note:** `disable_hybrid_access_mode` is a required field with no default. When `True`, IAMAllowedPrincipal permissions are revoked from the Glue table, enforcing Lake Formation-only governance. **Warning:** this may break existing jobs (e.g., training, processing, ETL) that access the table via IAM-based permissions. After this change, all principals must be granted access through Lake Formation. When `False`, an interactive prompt asks the user to confirm proceeding with hybrid access mode.\n",
34+
"> **Note:** `hybrid_access_mode_enabled` is a required field with no default. When `False`, IAMAllowedPrincipal permissions are revoked from the Glue table, enforcing Lake Formation-only governance. **Warning:** this may break existing jobs (e.g., training, processing, ETL) that access the table via IAM-based permissions. After this change, all principals must be granted access through Lake Formation.\n",
3535
"\n",
3636
"### New Parameter in `FeatureGroupManager.create()`: `lake_formation_config`\n",
3737
"\n",
@@ -51,8 +51,8 @@
5151
"\n",
5252
"```python\n",
5353
"fg.enable_lake_formation(\n",
54-
" disable_hybrid_access_mode=True, # Revoke IAMAllowedPrincipal permissions (REQUIRED)\n",
55-
" acknowledge_risk=None, # None=interactive prompt, True=skip prompt, False=abort\n",
54+
" hybrid_access_mode_enabled, # Revoke IAMAllowedPrincipal permissions (REQUIRED)\n",
55+
" acknowledge_risk, # True=proceed, False=abort (REQUIRED)\n",
5656
" use_service_linked_role=True, # Use LF service-linked role (default)\n",
5757
" registration_role_arn=None, # Custom role ARN (if not using SLR)\n",
5858
" wait_for_active=False, # Wait for Feature Group to be Created\n",
@@ -65,7 +65,7 @@
6565
"{\n",
6666
" \"s3_location_registered\": True,\n",
6767
" \"lf_permissions_granted\": True,\n",
68-
" \"hybrid_access_mode_disabled\": True # Only True when disable_hybrid_access_mode=True\n",
68+
" \"hybrid_access_mode_enabled\": False # Only False when hybrid_access_mode_enabled=False\n",
6969
"}\n",
7070
"```\n",
7171
"\n",
@@ -100,14 +100,14 @@
100100
"\n",
101101
"### Step 3: Revoke IAMAllowedPrincipal Permissions (conditional)\n",
102102
"\n",
103-
"This step only executes when `disable_hybrid_access_mode=True`. By default, Glue tables allow access to any IAM principal with appropriate IAM permissions (`IAMAllowedPrincipal`). This step revokes that default permission, ensuring that:\n",
103+
"This step only executes when `hybrid_access_mode_enabled=False`. By default, Glue tables allow access to any IAM principal with appropriate IAM permissions (`IAMAllowedPrincipal`). This step revokes that default permission, ensuring that:\n",
104104
"\n",
105105
"- Access is now controlled exclusively through Lake Formation\n",
106106
"- Only principals explicitly granted permissions via Lake Formation can access the data\n",
107107
"\n",
108108
"**Warning:** Revoking IAMAllowedPrincipal may break existing jobs (e.g., training, processing, ETL) that access the table via IAM-based permissions. After this change, all principals must be granted access through Lake Formation.\n",
109109
"\n",
110-
"When `disable_hybrid_access_mode=False`, this step is skipped and an interactive prompt asks the user to confirm proceeding with hybrid access mode (IAM + Lake Formation permissions coexist).\n",
110+
"When `hybrid_access_mode_enabled=True`, this step is skipped and hybrid access mode remains active (IAM + Lake Formation permissions coexist). The `acknowledge_risk=True` parameter confirms acceptance of this configuration.\n",
111111
"\n",
112112
"### Step 4: Recommended S3 Deny Policy (always logged)\n",
113113
"\n",
@@ -409,22 +409,6 @@
409409
"Grant your Execution role permission to create and describe tables under `sagemaker_featurestore` database"
410410
]
411411
},
412-
{
413-
"cell_type": "code",
414-
"execution_count": null,
415-
"metadata": {},
416-
"outputs": [],
417-
"source": [
418-
"lf_client.grant_permissions(\n",
419-
" Principal={\"DataLakePrincipalIdentifier\": EXECUTION_ROLE_ARN},\n",
420-
" Resource={\n",
421-
" \"Database\": {\"Name\": \"sagemaker_featurestore\"}\n",
422-
" },\n",
423-
" Permissions=[\"CREATE_TABLE\", \"DESCRIBE\"],\n",
424-
" PermissionsWithGrantOption=[],\n",
425-
")\n"
426-
]
427-
},
428412
{
429413
"cell_type": "markdown",
430414
"metadata": {},
@@ -599,7 +583,7 @@
599583
"lake_formation_config = LakeFormationConfig(\n",
600584
" enabled=True,\n",
601585
" use_service_linked_role=True,\n",
602-
" disable_hybrid_access_mode=False,\n",
586+
" hybrid_access_mode_enabled=True,\n",
603587
" acknowledge_risk=True\n",
604588
")\n",
605589
"print(\"\\nLake Formation Config:\")\n",
@@ -830,7 +814,7 @@
830814
"feature_group = FeatureGroupManager.get(FG_NAME_WORKFLOW2, session=boto_session)\n",
831815
"result = feature_group.enable_lake_formation( # new method\n",
832816
" use_service_linked_role=True,\n",
833-
" disable_hybrid_access_mode=True,\n",
817+
" hybrid_access_mode_enabled=False,\n",
834818
" acknowledge_risk=True\n",
835819
")\n",
836820
"data_catalog_config_2 = feature_group.offline_store_config.data_catalog_config\n",
@@ -839,7 +823,7 @@
839823
"print(f\"\\nLake Formation setup results:\")\n",
840824
"print(f\" s3_location_registered: {result['s3_location_registered']}\")\n",
841825
"print(f\" lf_permissions_granted: {result['lf_permissions_granted']}\")\n",
842-
"print(f\" hybrid_access_mode_disabled: {result['hybrid_access_mode_disabled']}\")"
826+
"print(f\" hybrid_access_mode_enabled: {result['hybrid_access_mode_enabled']}\")"
843827
]
844828
},
845829
{
@@ -891,6 +875,22 @@
891875
"### Grant Data Scientist Permission to Query the Table"
892876
]
893877
},
878+
{
879+
"cell_type": "markdown",
880+
"metadata": {},
881+
"source": [
882+
"we try to query before granting lakeformation permissions. Should fail unless the data scientist role was already granted lakefomration permission\n"
883+
]
884+
},
885+
{
886+
"cell_type": "code",
887+
"execution_count": null,
888+
"metadata": {},
889+
"outputs": [],
890+
"source": [
891+
"query_offline_store(str(data_catalog_config_2.database), str(data_catalog_config_2.table_name), data_scientist_session)"
892+
]
893+
},
894894
{
895895
"cell_type": "code",
896896
"execution_count": null,
@@ -1086,7 +1086,7 @@
10861086
],
10871087
"metadata": {
10881088
"kernelspec": {
1089-
"display_name": "v3-lf",
1089+
"display_name": "Python 3 (ipykernel)",
10901090
"language": "python",
10911091
"name": "python3"
10921092
},
@@ -1105,7 +1105,13 @@
11051105
"widgets": {
11061106
"application/vnd.jupyter.widget-state+json": {
11071107
"state": {
1108-
"cbfddeb610c74e7886a4dcff89f2eb2e": {
1108+
"9293a7c9ef3d4430b61a6abe6a434fa7": {
1109+
"model_module": "@jupyter-widgets/base",
1110+
"model_module_version": "2.0.0",
1111+
"model_name": "LayoutModel",
1112+
"state": {}
1113+
},
1114+
"e1dbeb64626e41b7bedd11144f50f168": {
11091115
"model_module": "@jupyter-widgets/base",
11101116
"model_module_version": "2.0.0",
11111117
"model_name": "LayoutModel",

0 commit comments

Comments
 (0)