templates/lab_template-old.yml [954:1232]:
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
      EnableIAMDatabaseAuthentication: true
      AssociatedRoles:
        - RoleArn: !GetAtt roleServiceIntegration.Arn
      Tags:
        - Key: Name
          Value: !If [ condEventEngine, "auroralab-mysql-cluster", !Sub "${AWS::StackName}-mysql-cluster" ]

## Deploy cluster node #1 (may or may not be writer depending which one initializes first)
  dbNode1:
    Type: "AWS::RDS::DBInstance"
    Condition: condDeployDBCluster
    Properties:
      DBClusterIdentifier: !Ref dbCluster
      DBInstanceIdentifier: !If [ condEventEngine, "auroralab-mysql-node-1", !Sub "${AWS::StackName}-mysql-node-1" ]
      CopyTagsToSnapshot: true
      DBInstanceClass: !FindInMap [ RegionalSettings, !Ref "AWS::Region", nodeType ]
      Engine: !FindInMap [ ClusterSettings, global, dbEngine ]
      MonitoringInterval: 1
      MonitoringRoleArn: !GetAtt roleEnhancedMonitoring.Arn
      PubliclyAccessible: false
      EnablePerformanceInsights: true
      PerformanceInsightsRetentionPeriod: 7
      Tags:
        - Key: Name
          Value: !If [ condEventEngine, "auroralab-mysql-node-1", !Sub "${AWS::StackName}-mysql-node-1" ]

## Deploy cluster node #2 (may or may not be writer depending which one initializes first)
  dbNode2:
    Type: "AWS::RDS::DBInstance"
    Condition: condDeployDBCluster
    Properties:
      DBClusterIdentifier: !Ref dbCluster
      DBInstanceIdentifier: !If [ condEventEngine, "auroralab-mysql-node-2", !Sub "${AWS::StackName}-mysql-node-2" ]
      CopyTagsToSnapshot: true
      DBInstanceClass: !FindInMap [ RegionalSettings, !Ref "AWS::Region", nodeType ]
      Engine: !FindInMap [ ClusterSettings, global, dbEngine ]
      MonitoringInterval: 1
      MonitoringRoleArn: !GetAtt roleEnhancedMonitoring.Arn
      PubliclyAccessible: false
      EnablePerformanceInsights: true
      PerformanceInsightsRetentionPeriod: 7
      Tags:
        - Key: Name
          Value: !If [ condEventEngine, "auroralab-mysql-node-2", !Sub "${AWS::StackName}-mysql-node-2" ]

## Role to overcome current limitations in CFN ScalableTarget implemetation
## This role is *NOT* actively used by any resource and service, but must be present
  roleScalableTarget:
    Type: "AWS::IAM::Role"
    Condition: condDeployDBCluster
    Properties:
      RoleName: !If [ condEventEngine, !Sub "auroralab-scaling-${AWS::Region}", !Sub "${AWS::StackName}-scaling-${AWS::Region}" ]
      Description: "Role to integrate the Aurora DB cluster with Application AutoScaling for read replica auto scaling."
      AssumeRolePolicyDocument:
        Version: 2012-10-17
        Statement:
          - Effect: Allow
            Action:
              - "sts:AssumeRole"
            Principal:
              Service:
                - "rds.application-autoscaling.amazonaws.com"
      Tags:
        - Key: Name
          Value: !If [ condEventEngine, !Sub "auroralab-scaling-${AWS::Region}", !Sub "${AWS::StackName}-scaling-${AWS::Region}" ]

## Register the scalable target
## Bug fix: when the stack name contains uppercase letters,
## the DB cluster identifier is actually lowercased, but the resource ID
## still contains uppercase, so you get a mismatch on the scalable target ResourceId
  dbScalableTarget:
    Type: "AWS::ApplicationAutoScaling::ScalableTarget"
    Condition: condDeployDBCluster
    DependsOn: [ dbNode1, dbNode2 ]
    Properties:
      ServiceNamespace: rds
      ScalableDimension: "rds:cluster:ReadReplicaCount"
      ResourceId: !GetAtt resLabSupport.DBClusterScalableTarget
      MaxCapacity: !FindInMap [ ClusterSettings, scaling, maxCapacity ]
      MinCapacity: !FindInMap [ ClusterSettings, scaling, minCapacity ]
      RoleARN: !GetAtt roleScalableTarget.Arn

## Add scaling policy
  dbScalingPolicy:
    Type: "AWS::ApplicationAutoScaling::ScalingPolicy"
    Condition: condDeployDBCluster
    Properties:
      PolicyName: !If [ condEventEngine, "auroralab-autoscale-readers", !Sub "${AWS::StackName}-autoscale-readers" ]
      PolicyType: TargetTrackingScaling
      ScalingTargetId: !Ref dbScalableTarget
      TargetTrackingScalingPolicyConfiguration:
        PredefinedMetricSpecification:
          PredefinedMetricType: RDSReaderAverageCPUUtilization
        ScaleInCooldown: 180
        ScaleOutCooldown: 180
        TargetValue: !FindInMap [ ClusterSettings, scaling, cpuLoadTarget ]

## Create sysbench prep SSM document
  ssmDocSysbenchTest:
    Type: "AWS::SSM::Document"
    Properties:
      DocumentType: Command
      Name: !If [ condEventEngine, "auroralab-sysbench-test", !Sub "${AWS::StackName}-sysbench-test" ]
      Tags:
        - Key: Name
          Value: !If [ condEventEngine, "auroralab-sysbench-test", !Sub "${AWS::StackName}-sysbench-test" ]
      Content:
        schemaVersion: '2.2'
        description: "SysBench Percona TPCC-LIKE Preparation"
        parameters:
          clusterEndpoint:
            type: String
            description: "Aurora Cluster Endpoint"
            default: !If [ condDeployDBCluster, !GetAtt dbCluster.Endpoint.Address, "" ]
          dbUser:
            type: String
            description: "DB User"
            default: !If [ condDeployDBCluster, !Join [ "", [ "{{resolve:secretsmanager:", !Ref secretClusterAdminUser, ":SecretString:username}}" ] ], "" ]
          dbPassword:
            type: String
            description: "DB Password"
            default: !If [ condDeployDBCluster, !Join [ "", [ "{{resolve:secretsmanager:", !Ref secretClusterAdminUser, ":SecretString:password}}" ] ], "" ]
          dbSchema:
            type: String
            description: "DB Schema"
            default: !FindInMap [ ClusterSettings, sysbench, dbSchema ]
          dbDriver:
            type: String
            description: "DB Driver"
            default: !FindInMap [ ClusterSettings, global, dbDriver ]
            allowedValues: [ mysql, pgsql ]
          runTime:
            type: String
            description: "Test Runtime"
            default: !FindInMap [ ClusterSettings, sysbench, runTime ]
          numThreads:
            type: String
            description: Threads
            default: !FindInMap [ ClusterSettings, sysbench, numThreads ]
          numTables:
            type: String
            description: Tables
            default: !FindInMap [ ClusterSettings, sysbench, numTables ]
          numScale:
            type: String
            description: Scale
            default: !FindInMap [ ClusterSettings, sysbench, numWarehouses ]
        mainSteps:
        - action: aws:runShellScript
          name: SysBenchTpccPrepare
          inputs:
            runCommand:
            - 'echo "DROP SCHEMA IF EXISTS {{ dbSchema }}; CREATE SCHEMA {{ dbSchema }};" | mysql -h{{ clusterEndpoint }} -u{{ dbUser }} -p"{{ dbPassword }}" && cd /home/ec2-user/environment/sysbench-tpcc && ./tpcc.lua --mysql-host={{ clusterEndpoint }} --mysql-user={{ dbUser }} --mysql-password="{{ dbPassword }}" --mysql-db={{ dbSchema }} --threads={{ numThreads }} --tables={{ numTables }} --scale={{ numScale }} --time={{ runTime }} --db-driver={{ dbDriver }} prepare'
        - action: aws:runShellScript
          name: SysBenchTpccRun
          inputs:
            runCommand:
            - 'cd /home/ec2-user/environment/sysbench-tpcc && ./tpcc.lua --mysql-host={{ clusterEndpoint }} --mysql-user={{ dbUser }} --mysql-password="{{ dbPassword }}" --mysql-db={{ dbSchema }} --mysql-ignore-errors=all --threads={{ numThreads }} --tables={{ numTables }} --scale={{ numScale }} --time={{ runTime }} --db-driver={{ dbDriver }} run'

## Create a role for the notebook.
  roleMLNotebook:
    Type: "AWS::IAM::Role"
    Condition: condDeployMLResources
    Properties:
      RoleName: !If [ condEventEngine, !Sub "auroralab-ml-${AWS::Region}", !Sub "${AWS::StackName}-ml-${AWS::Region}" ]
      AssumeRolePolicyDocument:
        Version: 2012-10-17
        Statement:
          - Effect: Allow
            Action:
              - "sts:AssumeRole"
            Principal:
              Service:
                - "sagemaker.amazonaws.com"
      ManagedPolicyArns:
        - "arn:aws:iam::aws:policy/AmazonSageMakerFullAccess"
      Policies:
        - PolicyName: inline-policy
          PolicyDocument:
            Version: 2012-10-17
            Statement:
              - Effect: Allow
                Action:
                  - "s3:ListBucket"
                  - "s3:GetObject"
                  - "s3:GetObjectVersion"
                  - "s3:DeleteObject"
                  - "s3:ListMultipartUploadParts"
                  - "s3:PutObject"
                Resource:
                  - "arn:aws:s3:::*/*"
                  - "arn:aws:s3:::*"
      Tags:
        - Key: Name
          Value: !If [ condEventEngine, !Sub "auroralab-ml-${AWS::Region}", !Sub "${AWS::StackName}-ml-${AWS::Region}" ]

## Create a Sagemaker Lifecycle hook, which will clone the github repo and get the Jupyter notebook and other resources needed to build the model.
## using nohup, so the script keeps running after 5 minutes. The onstart event fails, if script doesn't finish in 5 minutes.
  smMLNotebookHook:
    Type: "AWS::SageMaker::NotebookInstanceLifecycleConfig"
    Condition: condDeployMLResources
    Properties:
      NotebookInstanceLifecycleConfigName: !If [ condEventEngine, "auroralab-notebook-hook", !Sub "${AWS::StackName}-notebook-hook" ]
      OnCreate:
        - Content:
            Fn::Base64: !Sub |
              #!/bin/bash

              set -e
              sudo -u ec2-user -i <<EOF
              unset SUDO_UID
              python3 -m pip install sagemaker boto3 sagemaker_containers
              cd /home/ec2-user/SageMaker/
              wget https://[[website]]/support/notebook_churn.py
              wget https://[[website]]/support/sample_churn_data.zip
              sed -i "s%mlbucketplaceholder%${bucketLabData}%" notebook_churn.py
              sudo mkdir -p /opt/ml/code/
              cd /home/ec2-user/SageMaker/
              unzip -o sample_churn_data.zip
              nohup ipython notebook_churn.py>nohup.out &

## Create the Sagemake Jupyter book if the lab condition allows it.
  smMLNotebook:
    Type: "AWS::SageMaker::NotebookInstance"
    Condition: condDeployMLResources
    Properties:
      InstanceType: !FindInMap [ MLSettings, global, notebookType ]
      RootAccess: Enabled
      RoleArn: !GetAtt roleMLNotebook.Arn
      NotebookInstanceName: !If [ condEventEngine, "auroralab-notebook", !Sub "${AWS::StackName}-notebook" ]
      LifecycleConfigName: !GetAtt smMLNotebookHook.NotebookInstanceLifecycleConfigName
      Tags:
        - Key: Name
          Value: !If [ condEventEngine, "auroralab-notebook", !Sub "${AWS::StackName}-notebook" ]

## Create role for use with the lab support function
  roleLabSupport:
    Type: "AWS::IAM::Role"
    Properties:
      RoleName: !If [ condEventEngine, !Sub "auroralab-support-${AWS::Region}", !Sub "${AWS::StackName}-support-${AWS::Region}" ]
      Description: "Role to permit the Lambda support functions to interact with relevant AWS APIs."
      AssumeRolePolicyDocument:
        Version: 2012-10-17
        Statement:
          - Effect: Allow
            Action:
              - "sts:AssumeRole"
            Principal:
              Service:
                - "lambda.amazonaws.com"
      Policies:
        - PolicyName: inline-policy
          PolicyDocument:
            Version: 2012-10-17
            Statement:
              - Effect: Allow
                Action:
                  - "logs:CreateLogGroup"
                  - "logs:CreateLogStream"
                  - "logs:PutLogEvents"
                Resource: "arn:aws:logs:*:*:*"
              - Effect: Allow
                Action:
                  - cloudformation:DescribeStacks
                  - cloudformation:DescribeStackEvents
                  - cloudformation:DescribeStackResource
                  - cloudformation:DescribeStackResources
                  - ec2:DescribeInstances
                  - ec2:AssociateIamInstanceProfile
                  - ec2:ModifyInstanceAttribute
                  - ec2:ReplaceIamInstanceProfileAssociation
                  - ec2:DescribeIamInstanceProfileAssociations
                  - ec2:DisassociateIamInstanceProfile
                  - ec2:ModifyInstanceAttribute
                  - ec2:ReplaceIamInstanceProfileAssociation
                  - iam:ListInstanceProfiles
                  - iam:PassRole
                  - ssm:DescribeInstanceInformation
                  - ssm:SendCommand
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -



templates/lab_template.yml [1046:1324]:
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
      EnableIAMDatabaseAuthentication: true
      AssociatedRoles:
        - RoleArn: !GetAtt roleServiceIntegration.Arn
      Tags:
        - Key: Name
          Value: !If [ condEventEngine, "auroralab-mysql-cluster", !Sub "${AWS::StackName}-mysql-cluster" ]

## Deploy cluster node #1 (may or may not be writer depending which one initializes first)
  dbNode1:
    Type: "AWS::RDS::DBInstance"
    Condition: condDeployDBCluster
    Properties:
      DBClusterIdentifier: !Ref dbCluster
      DBInstanceIdentifier: !If [ condEventEngine, "auroralab-mysql-node-1", !Sub "${AWS::StackName}-mysql-node-1" ]
      CopyTagsToSnapshot: true
      DBInstanceClass: !FindInMap [ RegionalSettings, !Ref "AWS::Region", nodeType ]
      Engine: !FindInMap [ ClusterSettings, global, dbEngine ]
      MonitoringInterval: 1
      MonitoringRoleArn: !GetAtt roleEnhancedMonitoring.Arn
      PubliclyAccessible: false
      EnablePerformanceInsights: true
      PerformanceInsightsRetentionPeriod: 7
      Tags:
        - Key: Name
          Value: !If [ condEventEngine, "auroralab-mysql-node-1", !Sub "${AWS::StackName}-mysql-node-1" ]

## Deploy cluster node #2 (may or may not be writer depending which one initializes first)
  dbNode2:
    Type: "AWS::RDS::DBInstance"
    Condition: condDeployDBCluster
    Properties:
      DBClusterIdentifier: !Ref dbCluster
      DBInstanceIdentifier: !If [ condEventEngine, "auroralab-mysql-node-2", !Sub "${AWS::StackName}-mysql-node-2" ]
      CopyTagsToSnapshot: true
      DBInstanceClass: !FindInMap [ RegionalSettings, !Ref "AWS::Region", nodeType ]
      Engine: !FindInMap [ ClusterSettings, global, dbEngine ]
      MonitoringInterval: 1
      MonitoringRoleArn: !GetAtt roleEnhancedMonitoring.Arn
      PubliclyAccessible: false
      EnablePerformanceInsights: true
      PerformanceInsightsRetentionPeriod: 7
      Tags:
        - Key: Name
          Value: !If [ condEventEngine, "auroralab-mysql-node-2", !Sub "${AWS::StackName}-mysql-node-2" ]

## Role to overcome current limitations in CFN ScalableTarget implemetation
## This role is *NOT* actively used by any resource and service, but must be present
  roleScalableTarget:
    Type: "AWS::IAM::Role"
    Condition: condDeployDBCluster
    Properties:
      RoleName: !If [ condEventEngine, !Sub "auroralab-scaling-${AWS::Region}", !Sub "${AWS::StackName}-scaling-${AWS::Region}" ]
      Description: "Role to integrate the Aurora DB cluster with Application AutoScaling for read replica auto scaling."
      AssumeRolePolicyDocument:
        Version: 2012-10-17
        Statement:
          - Effect: Allow
            Action:
              - "sts:AssumeRole"
            Principal:
              Service:
                - "rds.application-autoscaling.amazonaws.com"
      Tags:
        - Key: Name
          Value: !If [ condEventEngine, !Sub "auroralab-scaling-${AWS::Region}", !Sub "${AWS::StackName}-scaling-${AWS::Region}" ]

## Register the scalable target
## Bug fix: when the stack name contains uppercase letters,
## the DB cluster identifier is actually lowercased, but the resource ID
## still contains uppercase, so you get a mismatch on the scalable target ResourceId
  dbScalableTarget:
    Type: "AWS::ApplicationAutoScaling::ScalableTarget"
    Condition: condDeployDBCluster
    DependsOn: [ dbNode1, dbNode2 ]
    Properties:
      ServiceNamespace: rds
      ScalableDimension: "rds:cluster:ReadReplicaCount"
      ResourceId: !GetAtt resLabSupport.DBClusterScalableTarget
      MaxCapacity: !FindInMap [ ClusterSettings, scaling, maxCapacity ]
      MinCapacity: !FindInMap [ ClusterSettings, scaling, minCapacity ]
      RoleARN: !GetAtt roleScalableTarget.Arn

## Add scaling policy
  dbScalingPolicy:
    Type: "AWS::ApplicationAutoScaling::ScalingPolicy"
    Condition: condDeployDBCluster
    Properties:
      PolicyName: !If [ condEventEngine, "auroralab-autoscale-readers", !Sub "${AWS::StackName}-autoscale-readers" ]
      PolicyType: TargetTrackingScaling
      ScalingTargetId: !Ref dbScalableTarget
      TargetTrackingScalingPolicyConfiguration:
        PredefinedMetricSpecification:
          PredefinedMetricType: RDSReaderAverageCPUUtilization
        ScaleInCooldown: 180
        ScaleOutCooldown: 180
        TargetValue: !FindInMap [ ClusterSettings, scaling, cpuLoadTarget ]

## Create sysbench prep SSM document
  ssmDocSysbenchTest:
    Type: "AWS::SSM::Document"
    Properties:
      DocumentType: Command
      Name: !If [ condEventEngine, "auroralab-sysbench-test", !Sub "${AWS::StackName}-sysbench-test" ]
      Tags:
        - Key: Name
          Value: !If [ condEventEngine, "auroralab-sysbench-test", !Sub "${AWS::StackName}-sysbench-test" ]
      Content:
        schemaVersion: '2.2'
        description: "SysBench Percona TPCC-LIKE Preparation"
        parameters:
          clusterEndpoint:
            type: String
            description: "Aurora Cluster Endpoint"
            default: !If [ condDeployDBCluster, !GetAtt dbCluster.Endpoint.Address, "" ]
          dbUser:
            type: String
            description: "DB User"
            default: !If [ condDeployDBCluster, !Join [ "", [ "{{resolve:secretsmanager:", !Ref secretClusterAdminUser, ":SecretString:username}}" ] ], "" ]
          dbPassword:
            type: String
            description: "DB Password"
            default: !If [ condDeployDBCluster, !Join [ "", [ "{{resolve:secretsmanager:", !Ref secretClusterAdminUser, ":SecretString:password}}" ] ], "" ]
          dbSchema:
            type: String
            description: "DB Schema"
            default: !FindInMap [ ClusterSettings, sysbench, dbSchema ]
          dbDriver:
            type: String
            description: "DB Driver"
            default: !FindInMap [ ClusterSettings, global, dbDriver ]
            allowedValues: [ mysql, pgsql ]
          runTime:
            type: String
            description: "Test Runtime"
            default: !FindInMap [ ClusterSettings, sysbench, runTime ]
          numThreads:
            type: String
            description: Threads
            default: !FindInMap [ ClusterSettings, sysbench, numThreads ]
          numTables:
            type: String
            description: Tables
            default: !FindInMap [ ClusterSettings, sysbench, numTables ]
          numScale:
            type: String
            description: Scale
            default: !FindInMap [ ClusterSettings, sysbench, numWarehouses ]
        mainSteps:
        - action: aws:runShellScript
          name: SysBenchTpccPrepare
          inputs:
            runCommand:
            - 'echo "DROP SCHEMA IF EXISTS {{ dbSchema }}; CREATE SCHEMA {{ dbSchema }};" | mysql -h{{ clusterEndpoint }} -u{{ dbUser }} -p"{{ dbPassword }}" && cd /home/ec2-user/environment/sysbench-tpcc && ./tpcc.lua --mysql-host={{ clusterEndpoint }} --mysql-user={{ dbUser }} --mysql-password="{{ dbPassword }}" --mysql-db={{ dbSchema }} --threads={{ numThreads }} --tables={{ numTables }} --scale={{ numScale }} --time={{ runTime }} --db-driver={{ dbDriver }} prepare'
        - action: aws:runShellScript
          name: SysBenchTpccRun
          inputs:
            runCommand:
            - 'cd /home/ec2-user/environment/sysbench-tpcc && ./tpcc.lua --mysql-host={{ clusterEndpoint }} --mysql-user={{ dbUser }} --mysql-password="{{ dbPassword }}" --mysql-db={{ dbSchema }} --mysql-ignore-errors=all --threads={{ numThreads }} --tables={{ numTables }} --scale={{ numScale }} --time={{ runTime }} --db-driver={{ dbDriver }} run'

## Create a role for the notebook.
  roleMLNotebook:
    Type: "AWS::IAM::Role"
    Condition: condDeployMLResources
    Properties:
      RoleName: !If [ condEventEngine, !Sub "auroralab-ml-${AWS::Region}", !Sub "${AWS::StackName}-ml-${AWS::Region}" ]
      AssumeRolePolicyDocument:
        Version: 2012-10-17
        Statement:
          - Effect: Allow
            Action:
              - "sts:AssumeRole"
            Principal:
              Service:
                - "sagemaker.amazonaws.com"
      ManagedPolicyArns:
        - "arn:aws:iam::aws:policy/AmazonSageMakerFullAccess"
      Policies:
        - PolicyName: inline-policy
          PolicyDocument:
            Version: 2012-10-17
            Statement:
              - Effect: Allow
                Action:
                  - "s3:ListBucket"
                  - "s3:GetObject"
                  - "s3:GetObjectVersion"
                  - "s3:DeleteObject"
                  - "s3:ListMultipartUploadParts"
                  - "s3:PutObject"
                Resource:
                  - "arn:aws:s3:::*/*"
                  - "arn:aws:s3:::*"
      Tags:
        - Key: Name
          Value: !If [ condEventEngine, !Sub "auroralab-ml-${AWS::Region}", !Sub "${AWS::StackName}-ml-${AWS::Region}" ]

## Create a Sagemaker Lifecycle hook, which will clone the github repo and get the Jupyter notebook and other resources needed to build the model.
## using nohup, so the script keeps running after 5 minutes. The onstart event fails, if script doesn't finish in 5 minutes.
  smMLNotebookHook:
    Type: "AWS::SageMaker::NotebookInstanceLifecycleConfig"
    Condition: condDeployMLResources
    Properties:
      NotebookInstanceLifecycleConfigName: !If [ condEventEngine, "auroralab-notebook-hook", !Sub "${AWS::StackName}-notebook-hook" ]
      OnCreate:
        - Content:
            Fn::Base64: !Sub |
              #!/bin/bash

              set -e
              sudo -u ec2-user -i <<EOF
              unset SUDO_UID
              python3 -m pip install sagemaker boto3 sagemaker_containers
              cd /home/ec2-user/SageMaker/
              wget https://[[website]]/support/notebook_churn.py
              wget https://[[website]]/support/sample_churn_data.zip
              sed -i "s%mlbucketplaceholder%${bucketLabData}%" notebook_churn.py
              sudo mkdir -p /opt/ml/code/
              cd /home/ec2-user/SageMaker/
              unzip -o sample_churn_data.zip
              nohup ipython notebook_churn.py>nohup.out &

## Create the Sagemake Jupyter book if the lab condition allows it.
  smMLNotebook:
    Type: "AWS::SageMaker::NotebookInstance"
    Condition: condDeployMLResources
    Properties:
      InstanceType: !FindInMap [ MLSettings, global, notebookType ]
      RootAccess: Enabled
      RoleArn: !GetAtt roleMLNotebook.Arn
      NotebookInstanceName: !If [ condEventEngine, "auroralab-notebook", !Sub "${AWS::StackName}-notebook" ]
      LifecycleConfigName: !GetAtt smMLNotebookHook.NotebookInstanceLifecycleConfigName
      Tags:
        - Key: Name
          Value: !If [ condEventEngine, "auroralab-notebook", !Sub "${AWS::StackName}-notebook" ]

## Create role for use with the lab support function
  roleLabSupport:
    Type: "AWS::IAM::Role"
    Properties:
      RoleName: !If [ condEventEngine, !Sub "auroralab-support-${AWS::Region}", !Sub "${AWS::StackName}-support-${AWS::Region}" ]
      Description: "Role to permit the Lambda support functions to interact with relevant AWS APIs."
      AssumeRolePolicyDocument:
        Version: 2012-10-17
        Statement:
          - Effect: Allow
            Action:
              - "sts:AssumeRole"
            Principal:
              Service:
                - "lambda.amazonaws.com"
      Policies:
        - PolicyName: inline-policy
          PolicyDocument:
            Version: 2012-10-17
            Statement:
              - Effect: Allow
                Action:
                  - "logs:CreateLogGroup"
                  - "logs:CreateLogStream"
                  - "logs:PutLogEvents"
                Resource: "arn:aws:logs:*:*:*"
              - Effect: Allow
                Action:
                  - cloudformation:DescribeStacks
                  - cloudformation:DescribeStackEvents
                  - cloudformation:DescribeStackResource
                  - cloudformation:DescribeStackResources
                  - ec2:DescribeInstances
                  - ec2:AssociateIamInstanceProfile
                  - ec2:ModifyInstanceAttribute
                  - ec2:ReplaceIamInstanceProfileAssociation
                  - ec2:DescribeIamInstanceProfileAssociations
                  - ec2:DisassociateIamInstanceProfile
                  - ec2:ModifyInstanceAttribute
                  - ec2:ReplaceIamInstanceProfileAssociation
                  - iam:ListInstanceProfiles
                  - iam:PassRole
                  - ssm:DescribeInstanceInformation
                  - ssm:SendCommand
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -



