「AWS CloudFormation」内でコマンドが用意されていないインフラを「カスタムリソース」を使って自動構築させる：AWSチートシート

AWSTemplateFormatVersion: "2010-09-09"
Description: "サンプルテンプレートYAMLファイル"
 
Resources:
  GetSageMakerStudioDomainId:
    Type: Custom::CreateSageMakerStudioDomainLambda
    Version: 1.0
    Properties:
      ServiceToken: !GetAtt CreateSageMakerStudioDomainLambda.Arn
      ExecutionRoleArn: !GetAtt AmazonSageMakerCustomExecutionRole.Arn
 
  CreateSageMakerStudioDomainLambda:
    Type: AWS::Lambda::Function
    Properties:
      Code:
        ZipFile: |
          import json
          import boto3
          import cfnresponse
 
          def lambda_handler(event, context):
            print(event)
 
            try:
              #まずStudioLifecycleConfigを作成する。
 
              str='''
               #SagemakerStudioが立ち上がったときに適用されてほしいコマンドを入力
               mkdir -p .sampleFolder'''
               
              #==========================
              #studio_lifecycle_configの作成
 
              smclient = boto3.client('sagemaker')
 
              config = smclient.create_studio_lifecycle_config(
                  StudioLifecycleConfigName=config1',
                  StudioLifecycleConfigContent=Content,
                  StudioLifecycleConfigAppType='KernelGateway',
              )
              configArn = config["StudioLifecycleConfigArn"]
              print(configArn)
              
              #==========================
              #ここからはDomainの作成に必要な「Amazon Virtual Private Cloud 」（VPC）とSubnetを取得
 
              ec2client = boto3.client('ec2')
              
              vpclist = ec2client.describe_vpcs()
              default_vpcid = vpclist['Vpcs'][0]['VpcId']
 
              
              subnets = ec2client.describe_subnets(Filters=[{'Name':'vpc-id', 'Values':[default_vpcid]}])
              subnetid = subnets['Subnets'][0]['SubnetId']
              
              #==========================
              #Domainを作成（カスタムリソース外でも構わないが、今回は一緒にLambda内で実行）
              domain = smclient.create_domain(
                DomainName='SandboxSageMakerStudioDomain',
                AuthMode='IAM',
                DefaultUserSettings={
                    'ExecutionRole':event['ResourceProperties']['ExecutionRoleArn'],
                    'JupyterServerAppSettings': {
                        'DefaultResourceSpec': {
                            'InstanceType':'system',
                            'LifecycleConfigArn': configArn
                        },
                        'LifecycleConfigArns': [
                            configArn,
                        ]
                    },
                    'KernelGatewayAppSettings': {
                        'LifecycleConfigArns': [
                          configArn,
                        ]
                    }
                },
                SubnetIds=[subnetid,],
                VpcId=default_vpcid,
              )
              print(domain)
           
              response = domain
              cfnresponse.send(event, context, cfnresponse.SUCCESS, response)
              print(response)
            except Exception as e:
              cfnresponse.send(event, context, cfnresponse.FAILED, {})
              print(e)
 
      Handler: index.lambda_handler
      MemorySize: 128
      Role: !GetAtt AmazonSageMakerCustomExecutionRole.Arn
      Runtime: python3.6
      Timeout: 60
 
  AmazonSageMakerCustomExecutionRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Version: 2012-10-17
        Statement:
          - Effect: Allow
            Principal:
              Service: [lambda.amazonaws.com, sagemaker.amazonaws.com]
            Action: sts:AssumeRole
      Path: /
      Policies:
        - PolicyName: createSageMakerDomain
          PolicyDocument:
            Version: "2012-10-17"
            Statement:
              - Effect: Allow
                Resource: "*"
                Action:
                  [
                    "sagemaker:CreateDomain**",
                    "sagemaker:DeleteDomain**",
                    "s3:GetObject",
                    "s3:PutObject",
                    "s3:DeleteObject",
                    "s3:ListBucket",
                    "sts:AssumeRole",
                  ]
      ManagedPolicyArns:
        - "arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole"
        - "arn:aws:iam::aws:policy/AmazonSageMakerFullAccess"
        - "arn:aws:iam::aws:policy/AmazonVPCFullAccess"
# Outputs:

 GetSageMakerStudioDomainId:
    Type: Custom::CreateSageMakerStudioDomainLambda
    Version: 1.0
    Properties:
        ServiceToken: !GetAtt CreateSageMakerStudioDomainLambda.Arn
        ExecutionRoleArn: !GetAtt AmazonSageMakerCustomExecutionRole.Arn

event['ResourceProperties']['ExecutionRoleArn']

smclient = boto3.client('sagemaker')
config = smclient.create_studio_lifecycle_config(
    StudioLifecycleConfigName=custom_config1',
    StudioLifecycleConfigContent=Content,
    StudioLifecycleConfigAppType='KernelGateway'
)
configArn = config["StudioLifecycleConfigArn"]
print(configArn)