{
  "typeName" : "AWS::SageMaker::Model",
  "description" : "Resource type definition for AWS::SageMaker::Model",
  "sourceUrl" : "https://github.com/aws-cloudformation/aws-cloudformation-resource-providers-sagemaker",
  "definitions" : {
    "ContainerDefinition" : {
      "type" : "object",
      "description" : "Describes the container, as part of model definition.",
      "additionalProperties" : false,
      "properties" : {
        "ContainerHostname" : {
          "type" : "string",
          "description" : "This parameter is ignored for models that contain only a PrimaryContainer.\n\nWhen a ContainerDefinition is part of an inference pipeline, the value of the parameter uniquely identifies the container for the purposes of logging and metrics. For information, see [Use Logs and Metrics to Monitor an Inference Pipeline](https://docs.aws.amazon.com/sagemaker/latest/dg/inference-pipeline-logs-metrics.html). If you don't specify a value for this parameter for a ContainerDefinition that is part of an inference pipeline, a unique name is automatically assigned based on the position of the ContainerDefinition in the pipeline. If you specify a value for the ContainerHostName for any ContainerDefinition that is part of an inference pipeline, you must specify a value for the ContainerHostName parameter of every ContainerDefinition in that pipeline."
        },
        "Environment" : {
          "type" : "object",
          "description" : "The environment variables to set in the Docker container. Don't include any sensitive data in your environment variables.\n\nThe maximum length of each key and value in the Environment map is 1024 bytes. The maximum length of all keys and values in the map, combined, is 32 KB. If you pass multiple containers to a CreateModel request, then the maximum length of all of their maps, combined, is also 32 KB."
        },
        "Image" : {
          "type" : "string",
          "description" : "The path where inference code is stored. This can be either in Amazon EC2 Container Registry or in a Docker registry that is accessible from the same VPC that you configure for your endpoint. If you are using your own custom algorithm instead of an algorithm provided by SageMaker, the inference code must meet SageMaker requirements. SageMaker supports both registry/repository[:tag] and registry/repository[@digest] image path formats. For more information, see [Using Your Own Algorithms with Amazon SageMaker](https://docs.aws.amazon.com/sagemaker/latest/dg/your-algorithms.html)."
        },
        "ImageConfig" : {
          "$ref" : "#/definitions/ImageConfig"
        },
        "InferenceSpecificationName" : {
          "type" : "string",
          "description" : "The inference specification name in the model package version."
        },
        "Mode" : {
          "type" : "string",
          "description" : "Whether the container hosts a single model or multiple models.",
          "enum" : [ "SingleModel", "MultiModel" ]
        },
        "ModelDataSource" : {
          "$ref" : "#/definitions/ModelDataSource"
        },
        "ModelDataUrl" : {
          "type" : "string",
          "description" : "The S3 path where the model artifacts, which result from model training, are stored. This path must point to a single gzip compressed tar archive (.tar.gz suffix). The S3 path is required for SageMaker built-in algorithms, but not if you use your own algorithms. For more information on built-in algorithms, see [Common Parameters](https://docs.aws.amazon.com/sagemaker/latest/dg/sagemaker-algo-docker-registry-paths.html).\n\nIf you provide a value for this parameter, SageMaker uses AWS Security Token Service to download model artifacts from the S3 path you provide. AWS STS is activated in your AWS account by default. If you previously deactivated AWS STS for a region, you need to reactivate AWS STS for that region. For more information, see [Activating and Deactivating AWS STS in an AWS Region](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_temp_enable-regions.html) in the AWS Identity and Access Management User Guide"
        },
        "ModelPackageName" : {
          "type" : "string",
          "description" : "The name or Amazon Resource Name (ARN) of the model package to use to create the model."
        },
        "MultiModelConfig" : {
          "$ref" : "#/definitions/MultiModelConfig"
        }
      }
    },
    "HubAccessConfig" : {
      "type" : "object",
      "description" : "Configuration information specifying which hub contents have accessible deployment options.",
      "additionalProperties" : false,
      "properties" : {
        "HubContentArn" : {
          "type" : "string",
          "description" : "The ARN of the hub content for which deployment access is allowed."
        }
      },
      "required" : [ "HubContentArn" ]
    },
    "ImageConfig" : {
      "type" : "object",
      "description" : "Specifies whether the model container is in Amazon ECR or a private Docker registry accessible from your Amazon Virtual Private Cloud (VPC).",
      "additionalProperties" : false,
      "properties" : {
        "RepositoryAccessMode" : {
          "type" : "string",
          "description" : "Set this to one of the following values: Platform - The model image is hosted in Amazon ECR. Vpc - The model image is hosted in a private Docker registry in your VPC.",
          "enum" : [ "Platform", "Vpc" ]
        },
        "RepositoryAuthConfig" : {
          "$ref" : "#/definitions/RepositoryAuthConfig"
        }
      },
      "required" : [ "RepositoryAccessMode" ]
    },
    "InferenceExecutionConfig" : {
      "type" : "object",
      "description" : "Specifies details about how containers in a multi-container endpoint are run.",
      "additionalProperties" : false,
      "properties" : {
        "Mode" : {
          "type" : "string",
          "description" : "How containers in a multi-container are run.",
          "enum" : [ "Serial", "Direct" ]
        }
      },
      "required" : [ "Mode" ]
    },
    "ModelAccessConfig" : {
      "type" : "object",
      "description" : "The access configuration file to control access to the ML model. You can explicitly accept the model end-user license agreement (EULA) within the `ModelAccessConfig`.",
      "additionalProperties" : false,
      "properties" : {
        "AcceptEula" : {
          "type" : "boolean",
          "description" : "Specifies agreement to the model end-user license agreement (EULA). The `AcceptEula` value must be explicitly defined as `True` in order to accept the EULA that this model requires. You are responsible for reviewing and complying with any applicable license terms and making sure they are acceptable for your use case before downloading or using a model."
        }
      },
      "required" : [ "AcceptEula" ]
    },
    "ModelDataSource" : {
      "type" : "object",
      "description" : "Specifies the location of ML model data to deploy. If specified, you must specify one and only one of the available data sources.",
      "additionalProperties" : false,
      "properties" : {
        "S3DataSource" : {
          "$ref" : "#/definitions/S3DataSource"
        }
      },
      "required" : [ "S3DataSource" ]
    },
    "MultiModelConfig" : {
      "type" : "object",
      "description" : "Specifies additional configuration for multi-model endpoints.",
      "additionalProperties" : false,
      "properties" : {
        "ModelCacheSetting" : {
          "type" : "string",
          "description" : "Whether to cache models for a multi-model endpoint. By default, multi-model endpoints cache models so that a model does not have to be loaded into memory each time it is invoked. Some use cases do not benefit from model caching. For example, if an endpoint hosts a large number of models that are each invoked infrequently, the endpoint might perform better if you disable model caching. To disable model caching, set the value of this parameter to `Disabled`.",
          "enum" : [ "Enabled", "Disabled" ]
        }
      }
    },
    "RepositoryAuthConfig" : {
      "type" : "object",
      "description" : "Specifies an authentication configuration for the private docker registry where your model image is hosted. Specify a value for this property only if you specified `Vpc` as the value for the `RepositoryAccessMode` field of the `ImageConfig` object that you passed to a call to `CreateModel` and the private Docker registry where the model image is hosted requires authentication.",
      "additionalProperties" : false,
      "properties" : {
        "RepositoryCredentialsProviderArn" : {
          "type" : "string",
          "description" : "The Amazon Resource Name (ARN) of an AWS Lambda function that provides credentials to authenticate to the private Docker registry where your model image is hosted. For information about how to create an AWS Lambda function, see [Create a Lambda function with the console](https://docs.aws.amazon.com/lambda/latest/dg/getting-started-create-function.html) in the AWS Lambda Developer Guide"
        }
      },
      "required" : [ "RepositoryCredentialsProviderArn" ]
    },
    "S3DataSource" : {
      "type" : "object",
      "description" : "Specifies the S3 location of ML model data to deploy.",
      "additionalProperties" : false,
      "properties" : {
        "CompressionType" : {
          "type" : "string",
          "description" : "Specifies how the ML model data is prepared.",
          "enum" : [ "None", "Gzip" ]
        },
        "HubAccessConfig" : {
          "$ref" : "#/definitions/HubAccessConfig"
        },
        "ModelAccessConfig" : {
          "$ref" : "#/definitions/ModelAccessConfig"
        },
        "S3DataType" : {
          "type" : "string",
          "description" : "Specifies the type of ML model data to deploy.",
          "enum" : [ "S3Prefix", "S3Object" ]
        },
        "S3Uri" : {
          "type" : "string",
          "description" : "Specifies the S3 path of ML model data to deploy."
        }
      },
      "required" : [ "CompressionType", "S3DataType", "S3Uri" ]
    },
    "Tag" : {
      "type" : "object",
      "additionalProperties" : false,
      "properties" : {
        "Value" : {
          "type" : "string",
          "description" : "The tag key. Tag keys must be unique per resource."
        },
        "Key" : {
          "type" : "string",
          "description" : "The tag value."
        }
      },
      "required" : [ "Value", "Key" ]
    },
    "VpcConfig" : {
      "type" : "object",
      "description" : "Specifies an Amazon Virtual Private Cloud (VPC) that your SageMaker jobs, hosted models, and compute resources have access to. You can control access to and from your resources by configuring a VPC. For more information, see [Give SageMaker Access to Resources in your Amazon VPC](https://docs.aws.amazon.com/sagemaker/latest/dg/infrastructure-give-access.html).",
      "additionalProperties" : false,
      "properties" : {
        "SecurityGroupIds" : {
          "type" : "array",
          "description" : "The VPC security group IDs, in the form `sg-xxxxxxxx`. Specify the security groups for the VPC that is specified in the `Subnets` field.",
          "uniqueItems" : false,
          "insertionOrder" : false,
          "items" : {
            "type" : "string"
          }
        },
        "Subnets" : {
          "type" : "array",
          "description" : "The ID of the subnets in the VPC to which you want to connect your training job or model. For information about the availability of specific instance types, see [Supported Instance Types and Availability Zones](https://docs.aws.amazon.com/sagemaker/latest/dg/instance-types-az.html).",
          "uniqueItems" : false,
          "insertionOrder" : false,
          "items" : {
            "type" : "string"
          }
        }
      },
      "required" : [ "Subnets", "SecurityGroupIds" ]
    }
  },
  "properties" : {
    "Containers" : {
      "type" : "array",
      "description" : "Specifies the containers in the inference pipeline.",
      "uniqueItems" : false,
      "insertionOrder" : false,
      "items" : {
        "$ref" : "#/definitions/ContainerDefinition"
      }
    },
    "EnableNetworkIsolation" : {
      "type" : "boolean",
      "description" : "Isolates the model container. No inbound or outbound network calls can be made to or from the model container."
    },
    "ExecutionRoleArn" : {
      "type" : "string",
      "description" : "The Amazon Resource Name (ARN) of the IAM role that you specified for the model."
    },
    "InferenceExecutionConfig" : {
      "$ref" : "#/definitions/InferenceExecutionConfig"
    },
    "ModelArn" : {
      "type" : "string",
      "description" : "The Amazon Resource Name (ARN) of the model."
    },
    "ModelName" : {
      "description" : "The name of the new model.",
      "type" : "string"
    },
    "PrimaryContainer" : {
      "$ref" : "#/definitions/ContainerDefinition"
    },
    "Tags" : {
      "type" : "array",
      "description" : "An array of key-value pairs. You can use tags to categorize your AWS resources in different ways, for example, by purpose, owner, or environment. For more information, see [Tagging AWS Resources](https://docs.aws.amazon.com/general/latest/gr/aws_tagging.html).",
      "uniqueItems" : false,
      "insertionOrder" : false,
      "items" : {
        "$ref" : "#/definitions/Tag"
      }
    },
    "VpcConfig" : {
      "$ref" : "#/definitions/VpcConfig"
    }
  },
  "additionalProperties" : false,
  "createOnlyProperties" : [ "/properties/ExecutionRoleArn", "/properties/EnableNetworkIsolation", "/properties/InferenceExecutionConfig", "/properties/PrimaryContainer", "/properties/ModelName", "/properties/VpcConfig", "/properties/Containers" ],
  "primaryIdentifier" : [ "/properties/ModelArn" ],
  "readOnlyProperties" : [ "/properties/ModelArn" ],
  "tagging" : {
    "taggable" : true,
    "tagOnCreate" : true,
    "tagUpdatable" : true,
    "cloudFormationSystemTags" : true,
    "tagProperty" : "/properties/Tags",
    "permissions" : [ "sagemaker:ListTags", "sagemaker:AddTags", "sagemaker:DeleteTags" ]
  },
  "handlers" : {
    "create" : {
      "permissions" : [ "iam:PassRole", "sagemaker:AddTags", "sagemaker:CreateModel" ]
    },
    "read" : {
      "permissions" : [ "sagemaker:DescribeModel", "sagemaker:ListTags" ]
    },
    "update" : {
      "permissions" : [ "sagemaker:AddTags", "sagemaker:DeleteTags" ]
    },
    "delete" : {
      "permissions" : [ "sagemaker:DeleteModel" ]
    },
    "list" : {
      "permissions" : [ "sagemaker:ListModels" ]
    }
  }
}