mlops-multi-account-cdk template: downgrade ruby to 2.7; add CodeBuildAdminAccess to launch role

[hrvg]

Thanks for this great template! While experimenting with this solution, I found two issues. Happy to discuss.

Description of changes:

• fix(mlops-multi-account-cdk template): ⬇️ Downgrade from ruby 3.1 to ruby 2.7

  • this partly reverts #71
  • ruby 3.1 is not supported by codebuild.LinuxBuildImage.STANDARD_5_0
  • https://docs.aws.amazon.com/codebuild/latest/userguide/available-runtimes.html
  • https://docs.aws.amazon.com/cdk/api/v2/docs/aws-cdk-lib.aws_codebuild.LinuxBuildImage.html

• fix(mlops-multi-account-cdk template): 🛂 Add managed policy AWSCodeBuildAdminAccess to the products launch role

  • when that policy is not present, Service Catalog cannot terminate the provisioned product when part of the product deployment fails

By submitting this pull request, I confirm that you can use, modify, copy, and redistribute this contribution, under the terms of your choice.

[fotinosk]

Hello Hervé, thank you for the PR, I believe since the time you raised the PR, ruby 3.2 came into support, so I have upgraded to that version

[hrvg]

Hello Hervé, thank you for the PR, I believe since the time you raised the PR, ruby 3.2 came into support, so I have upgraded to that version

I don't think that is the case. I just checked the available runtimes which shows:

Version	Images
2.6	Amazon Linux 2 AArch64 standard:2.0 Ubuntu standard:5.0
2.7	Amazon Linux 2 AArch64 standard:2.0 Ubuntu standard:5.0
3.1	Amazon Linux 2 x86_64 standard:4.0 Ubuntu standard:6.0
3.2	Amazon Linux 2 x86_64 standard:5.0 Amazon Linux 2 AArch64 standard:3.0 Ubuntu standard:7.0

I think the confusion arises from the fact that STANDARD_5_0 actually refers to the Ubuntu standard:5.0 and not the Amazon Linux 2 x86_64 standard:5.0 image (AMAZON_LINUX_2_5) (docs).

[fotinosk]

Can you please confirm with Linux image is being used (you should be able to see it from CodeBuild), there is a common bug where the environment gets overwritten

[hrvg]

I just reproduced the error with ruby 3.1 for the service pipeline. As you mentioned, that is expected because that pipeline does not specify its build image and thus defaults to LinuxBuildImage.STANDARD_7_0. That is the issue I realized in https://github.com/aws-samples/sagemaker-custom-project-templates/pull/78/commits/f34d4af46bd22ab6c1fff2b07ce422e210e2d7f1 when I upgraded from 2.7 back to 3.1.

The issue is that the template pipeline constructs do specify the build image to LinuxBuildImage.STANDARD_5_0 which is not compatible with ruby 3.1. So either the ruby version is fixed or the build image has to change.

[fotinosk]

Yes, you are right. I just noticed that too. I was testing on that one when I upgraded to 3.2. PR has been now approved - thank you for raising this!