AWS AI Deployment Pipeline
Registry‑Driven Endpoint Promotion · Pipeline‑3
Triggering AWS Lambda via AWS EventBridge when the model is manually approved. This leads to automated running of the third CI/CD pipeline for promotion of the approved model from SageMaker Model Registry to real-time endpoints.
Project Summary
MLOps + Cloud · cross‑industry
Category
Domain
Method
Key Technologies
AWS + CI/CD stack
Problem & Objective
Problem
- Manual model deployment → inconsistent environments, security risks, slow promotion, lack of governance.
Objective
- Secure, repeatable, registry‑driven promotion to SageMaker endpoints via CDK + CI/CD (GitHub Actions + OIDC).
Solution & Architecture
Overview
CDK pipeline fetches latest Approved model from SageMaker Model Registry, provisions Model, EndpointConfig, Endpoint to Dev/Pre‑Prod/Prod. Triggered by GitHub Actions (OIDC auth). Endpoint configuration (instance, weight) YAML‑driven. Completes lifecycle started in Pipeline‑2.
Components
- AWS CDK (Python)
- SageMaker Model Registry
- Endpoint + EndpointConfig
- IAM / KMS / S3 / ECR
- CloudFormation backend
Scalability & reliability
- Managed SageMaker endpoints (HA)
- Config‑driven instance sizing
- CloudFormation rollback
- Multi‑environment isolation
MLOps & Automation
AI/ML type
Pipeline automation
CI/CD & containerisation
- GitHub Actions (orchestration) + OIDC → IAM
- AWS CDK (deployment as code)
- Docker/ECR for custom inference containers
Monitoring & optimisation
- CloudWatch metrics & logs for endpoints
- GitHub Actions + CloudFormation logs
- YAML‑driven instance tuning
- Cost guardrails via fixed defaults
Skills & Technologies
Primary skills
- MLOps Deployment / Model Serving – Advanced
- AWS CDK (IaC) – Advanced
- SageMaker Endpoints – Advanced
- CI/CD GitHub Actions – Advanced
Secondary tools
- AWS IAM, KMS, S3
- CloudFormation
- Docker / ECR
Languages
Challenges & Resolutions
Challenges
- Registry‑driven without hardcoding versions
- Secure CI/CD auth for prod
- Environment‑specific config
- IAM least‑privilege scoping
Resolutions
- Lookup latest Approved model
- OIDC‑based IAM roles for GitHub
- YAML‑driven endpoint configs
- Least‑privilege IAM + KMS encryption
CI/CD · AWS Mapping
Pipeline‑3 constructs
| Architecture Block | AWS CI/CD Construct (Pipeline‑3) |
|---|---|
| Source Repository | GitHub (deployment/IaC repo) |
| Trigger | GitHub Actions (manual / approval) |
| CI Runner | GitHub Linux runner (ubuntu‑latest) |
| Orchestration | AWS CDK (synth / deploy) |
| Infra Backend | AWS CloudFormation |
| Model Source | SageMaker Model Registry (approved packages) |
| Model Packaging | SageMaker Model (CfnModel from Registry) |
| Endpoint Configuration | SageMaker EndpointConfig (instance, weight) |
| Deployment Target | SageMaker Real‑time Endpoint (Dev/Pre‑Prod/Prod) |
| Artifact Storage | Amazon S3 (model artifacts) |
| Container Registry | Amazon ECR (custom images) |
| Security & Auth | OIDC (GitHub→AWS) + IAM roles |
| Endpoint Execution Role | IAM Role for SageMaker Endpoint runtime |
| Secrets / Config | AWS SSM Parameter Store (+ env vars) |
| Encryption | AWS KMS (endpoint data & artifacts) |
| Monitoring & Logs | Amazon CloudWatch Logs & Metrics (endpoint) + GitHub Actions Logs |
| Deployment Governance | Model Registry approvals + CDK-controlled promotion |
| Infrastructure State | CloudFormation Stack Events (rollback on failure) |
Process flow: GitHub → GitHub Actions → OIDC → IAM → CDK → CloudFormation → Model/EndpointConfig → Real‑time Endpoint.
AWS DevOps CI/CD – Reference Architecture
Pipeline‑3: Deployment / Promotion
Architecture Flow:
- Developer triggers deployment via GitHub Actions (manual/approval-based).
- GitHub Actions assumes AWS IAM Role via OIDC.
- CDK synth generates CloudFormation templates.
- CDK deploy provisions:
- SageMaker Model (from Registry)
- EndpointConfig (instance type, traffic)
- SageMaker Endpoint
- CloudFormation applies changes with rollback on failure.
- Logs visible in GitHub Actions + CloudFormation + CloudWatch.
Security & Guardrails:
- OIDC-based IAM roles
- Least-privilege endpoint execution roles
- KMS encryption for endpoint resources
- Env isolation (Dev / Pre-Prod / Prod)
Assets & References
MLOps CDK GitHub Action
Infrastructure-as-code and GitHub Actions workflow for platform provisioning.
View GitHub repoPsitron ML Build
Build repository for the ML pipeline stage and related implementation assets.
View GitHub repoPsitron ML Deploy
Deployment repository for ML release workflows and production delivery assets.
View GitHub repo