Release Notes

v1.0.1 (2026-06-15)

Bug Fixes

  • Fixed s3_prefix attribute not being set when source_control: s3 is configured — caused AttributeError during deploy-product validation (ALLOWED_ML_KEYS was missing s3_prefix)

v1.0.0 (2026-06-01)

Initial release of the ML Provisioner Tool.

Features

  • Tier-based provisioning — 3 tiers covering the full range of ML infrastructure needs:

    • Starter — foundation MLOps platform for small teams and proof-of-concept projects

    • Professional — enhanced monitoring, event-driven automation, and additional policies

    • Enterprise — VPC integration, KMS encryption, compliance monitoring, and permission boundaries

  • Dual source control — CodeCommit repositories or existing S3 bucket as pipeline source

  • Workload discriminator — deploy multiple independent ML products in the same environment without naming collisions

Note: Each stack provisions one ML use case. Use the workload field to deploy multiple independent ML products in the same environment without naming collisions.

  • VPC integration (enterprise) — attach to existing VPC via SSM Parameter Store paths or direct VPC ID

  • Two VPC modes (enterprise):

    • Standalone — ML Provisioner creates and manages its own endpoint Security Group

    • SG Provisioner — reads existing Security Group ID from SSM, no conflict with SG Provisioner

  • Route table support — optional route_table_ids for automatic S3 Gateway endpoint route associations

  • KMS encryption (enterprise) — Customer Managed Key applied to S3 artifacts bucket and CodePipeline artifact store

  • Compliance monitoring (enterprise) — CloudWatch Alarms for root account usage and unauthorized API calls, with SNS alerting

  • Parameter Store outputs — all deployed resource identifiers stored at /ml/{product-name}/ for downstream consumption

  • 12 CLI actions:

    • validate-config, list-products, show-product

    • create-policy, create-prov-template, validate-prov-template

    • create-review-report

    • test-deploy, deploy-product, delete-product

    • show-changes, check-drift

  • Least-privilege IAM policy generation — create-policy generates a scoped policy for the exact resources being deployed

  • Pre-deployment review report — HTML report summarising what will be deployed for stakeholder review

  • Post-deployment report — HTML deployment summary with stack outputs

  • Test deploy — isolated deployment with random suffix for safe pre-production validation

  • Drift detection — check-drift identifies resources modified outside of CloudFormation

  • Change preview — show-changes previews pending changes before updating a deployed stack

  • AWS Marketplace license validation — subscription validated on every action

Architecture

  • Config-driven YAML provisioning — single config file per deployment scenario

  • Tier blueprint system — starter.yaml, professional.yaml, enterprise.yaml define resource structures

  • CfnGenerator — constructs CloudFormation templates as Python dicts, no string substitution

  • ProductValidator — security checks before template generation (IAM wildcards, public S3, open ports, missing KMS)

  • Docker container with Cython-compiled modules for IP protection

  • Three tier images: ml-provisioner:starter, ml-provisioner:professional, ml-provisioner:enterprise

  • Common package integration (BaseCLI, logger, utilities)

Supported Scenarios

18 scenarios across 3 tiers — 4 starter, 4 professional, 10 enterprise. See Configuration Guide for the full scenario matrix.

Known Limitations

  • CodeCommit repositories are created per stack — no sharing across stacks (planned for v1.1.0 — see Roadmap)

  • AWS::SageMaker::Project provisioning deferred to SageMaker Provisioner (see Roadmap)

  • No cost estimation (planned for v1.2.0 — see Roadmap)