rstudio_sagemaker.yaml

Parameters:
  KeyName:
    Description: SSH key pair to use for instance login
    Type: AWS::EC2::KeyPair::KeyName
  InstanceTypeParameter:
    Type: String
    Default: t2.medium
    AllowedValues:
      - t2.medium
      - m2.large
    Description: Enter t2.medium or t2.large. Default is t2.medium.

Mappings:
  Region:
    us-east-1:
      HostAmi: ami-04505e74c0741db8d

Resources:
  VPC:
    Type: AWS::EC2::VPC
    Properties:
      CidrBlock: 10.0.0.0/16
      EnableDnsHostnames: true
      Tags:
      - Key: Name
        Value: RStudio SageMaker VPC

  InternetGateway:
    Type: AWS::EC2::InternetGateway
    Properties:
      Tags:
      - Key: Name
        Value: RStudio SageMaker Internet Gateway

  AttachGateway:
    Type: AWS::EC2::VPCGatewayAttachment
    Properties:
      VpcId: !Ref VPC
      InternetGatewayId: !Ref InternetGateway

  PublicSubnet:
    Type: AWS::EC2::Subnet
    Properties:
      VpcId: !Ref VPC
      CidrBlock: 10.0.0.0/24
      MapPublicIpOnLaunch: true
      AvailabilityZone: !Select
        - '0'
        - !GetAZs ''
      Tags:
        - Key: Name
          Value: RStudio SageMaker Public Subnet

  PublicRouteTable:
    Type: AWS::EC2::RouteTable
    Properties:
      VpcId: !Ref VPC
      Tags:
        - Key: Name
          Value: RStudio SageMaker Public Route Table

  PublicRoute:
    Type: AWS::EC2::Route
    Properties:
      RouteTableId: !Ref PublicRouteTable
      DestinationCidrBlock: 0.0.0.0/0
      GatewayId: !Ref InternetGateway

  PublicSubnetRouteTableAssociation:
    Type: AWS::EC2::SubnetRouteTableAssociation
    Properties:
      SubnetId: !Ref PublicSubnet
      RouteTableId: !Ref PublicRouteTable

  Instance:
    Type: AWS::EC2::Instance
    Properties:
      KeyName: !Ref KeyName
      InstanceType: 
        Ref: InstanceTypeParameter
      ImageId: !FindInMap [Region, !Ref "AWS::Region", HostAmi]
      IamInstanceProfile: !Ref InstanceProfile
      BlockDeviceMappings:
        - DeviceName: /dev/sda1
          Ebs:
            VolumeSize: '30'
            Encrypted: 'true'
      SubnetId: !Ref PublicSubnet
      SecurityGroupIds:
        - Ref: PublicSubnetSecurityGroup
      Tags:
        - Key: Name
          Value: RStudio Server
      UserData:
        Fn::Base64: !Sub |
          #!/bin/bash -xe
          sudo apt-get update -y
          sudo apt-get install -y libcurl-devel openssl-devel libxml2-devel python3
          sudo apt-get install docker.io -y
          sudo docker pull rocker/rstudio:4.2


  CPUAlarm:
    Type: AWS::CloudWatch::Alarm
    Properties:
      ActionsEnabled: true
      AlarmActions:
        - arn:aws:swf:us-east-1:068454867054:action/actions/AWS_EC2.InstanceId.Stop/1.0
      OKActions: []
      InsufficientDataActions: []
      MetricName: CPUUtilization
      Namespace: AWS/EC2
      Statistic: Average
      Dimensions:
          - Name: InstanceId
            Value: !Ref Instance
      Period: 3600
      EvaluationPeriods: 1
      DatapointsToAlarm: 1
      Threshold: 10
      ComparisonOperator: LessThanOrEqualToThreshold

  PublicSubnetSecurityGroup:
    Type: AWS::EC2::SecurityGroup
    Properties:
      GroupName: rstudio-sagemaker-sg
      GroupDescription: RStudio SageMaker Instance Security Group
      VpcId: !Ref VPC
      SecurityGroupIngress:
        - CidrIp: 0.0.0.0/0
          FromPort: '22'
          IpProtocol: tcp
          ToPort: '22'
        - CidrIp: 0.0.0.0/0
          FromPort: '8787'
          IpProtocol: tcp
          ToPort: '8787'

  EC2Role:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Statement:
          - Effect: Allow
            Principal:
              Service:
                - ec2.amazonaws.com
            Action:
              - sts:AssumeRole
      Path: "/"
      ManagedPolicyArns:
        - arn:aws:iam::aws:policy/IAMReadOnlyAccess
        - arn:aws:iam::aws:policy/AmazonSageMakerFullAccess
      RoleName: ec2-rstudio-sagemaker

  SageMakerRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Statement:
          - Effect: Allow
            Principal:
              Service:
                - sagemaker.amazonaws.com
            Action:
              - sts:AssumeRole
      Path: "/"
      ManagedPolicyArns:
        - arn:aws:iam::aws:policy/AmazonSageMakerFullAccess
      RoleName: sagemaker-service-role

  InstanceProfile:
    Type: AWS::IAM::InstanceProfile
    Properties:
      Path: "/"
      Roles:
      - Ref: EC2Role
      InstanceProfileName: rstudio-sagemaker-instance

Outputs:
  RStudio:
    Description: RStudio SSH command
    Value: !Sub "ssh -L 8787:localhost:8787 -i ${KeyName}.pem ec2-user@${Instance.PublicDnsName}"