Standalone Scenarios — Run Commands

All standalone scenarios share the same 12 actions. The only difference is the config file name.

Available Configurations

Config file	Source control	VPC source	Notes
globalbank-prod-c001-us-west-2-demand-forecasting-ml-codecommit-standalone-ssm.yaml	codecommit	parameter-store
globalbank-prod-c001-us-west-2-demand-forecasting-ml-codecommit-standalone-ssm-workload.yaml	codecommit	parameter-store	workload: rt, use_case: demand-fc
globalbank-prod-c001-us-west-2-demand-forecasting-ml-codecommit-standalone-direct.yaml	codecommit	direct
globalbank-prod-c001-us-west-2-demand-forecasting-ml-codecommit-standalone-direct-rtb.yaml	codecommit	direct	includes route table IDs
globalbank-prod-c001-us-west-2-demand-forecasting-ml-s3-standalone-ssm.yaml	s3	parameter-store
globalbank-prod-c001-us-west-2-demand-forecasting-ml-s3-standalone-direct.yaml	s3	direct

---

Prerequisites

In standalone mode the ML Provisioner creates and manages its own endpoint SecurityGroup. The SG Provisioner must NOT be deployed — standalone mode does not use it.

SG Provisioner — must not be deployed

aws cloudformation describe-stacks \
  --stack-name globalbank-prod-c001-us-west-2-sg-stack \
  --region us-west-2 \
  --query "Stacks[0].StackStatus" \
  --output text 2>&1

# If output contains 'does not exist' — good, proceed.
# If output is CREATE_COMPLETE — delete it before running any standalone scenario.

VPC — all scenarios

The VPC must exist in us-west-2:

aws ec2 describe-vpcs \
  --vpc-ids vpc-01d82c12b5b84da89 \
  --region us-west-2 \
  --query "Vpcs[0].VpcId" \
  --output text

# Expected: vpc-01d82c12b5b84da89

SSM VPC params — parameter-store scenarios only

Required by: codecommit-standalone-ssm, codecommit-standalone-ssm-workload, s3-standalone-ssm

aws ssm get-parameter \
  --name /vpc/globalbank-prod-c001-us-west-2-vpc/VPCId \
  --region us-west-2 \
  --query Parameter.Value \
  --output text

aws ssm get-parameter \
  --name /vpc/globalbank-prod-c001-us-west-2-vpc/PrivateSubnetIds \
  --region us-west-2 \
  --query Parameter.Value \
  --output text

# Expected: subnet-03ef04e345a08b008,subnet-059d4326e512a5a33,subnet-038b75b317519b7d4

If PrivateSubnetIds is missing, create it:

aws ssm put-parameter \
  --name /vpc/globalbank-prod-c001-us-west-2-vpc/PrivateSubnetIds \
  --value "subnet-03ef04e345a08b008,subnet-059d4326e512a5a33,subnet-038b75b317519b7d4" \
  --type StringList \
  --region us-west-2

Route tables — direct-rtb scenario only

Required by: codecommit-standalone-direct-rtb

The following private route tables must exist in the VPC:

rtb-045e45e43e7792d8a  (private-route-table-2a)
rtb-0208b3fc83187ae05  (private-route-table-2b)
rtb-0cf4bb2e112a25a9d  (private-route-table-2c)

aws ec2 describe-route-tables \
  --filters "Name=vpc-id,Values=vpc-01d82c12b5b84da89" \
  --region us-west-2 \
  --query "RouteTables[*].{Id:RouteTableId,Name:Tags[?Key=='Name'].Value|[0]}" \
  --output table

S3 source bucket — s3 scenarios only

Required by: s3-standalone-ssm, s3-standalone-direct

aws s3api head-bucket --bucket globalbank-c001-ml-source --region us-west-2
aws s3api get-bucket-versioning \
  --bucket globalbank-c001-ml-source \
  --region us-west-2 \
  --query Status \
  --output text

# Expected: Enabled

If missing, create it:

aws s3api create-bucket \
  --bucket globalbank-c001-ml-source \
  --region us-west-2 \
  --create-bucket-configuration LocationConstraint=us-west-2

aws s3api put-bucket-versioning \
  --bucket globalbank-c001-ml-source \
  --versioning-configuration Status=Enabled \
  --region us-west-2

aws s3api put-public-access-block \
  --bucket globalbank-c001-ml-source \
  --public-access-block-configuration \
    BlockPublicAcls=true,IgnorePublicAcls=true,BlockPublicPolicy=true,RestrictPublicBuckets=true \
  --region us-west-2

---

Set Config

Set the three variables before running the commands below. Pick one set from the list:

• codecommit-standalone-ssm — codecommit + parameter-store

• codecommit-standalone-ssm-workload — codecommit + parameter-store + workload

• codecommit-standalone-direct — codecommit + direct

• codecommit-standalone-direct-rtb — codecommit + direct + route tables

• s3-standalone-ssm — s3 + parameter-store

• s3-standalone-direct — s3 + direct

# codecommit + parameter-store
CONFIG=globalbank-prod-c001-us-west-2-demand-forecasting-ml-codecommit-standalone-ssm.yaml
STACK_NAME=globalbank-prod-c001-us-west-2-demand-forecasting-ml-stack
SSM_PATH=/ml/globalbank-prod-c001-us-west-2-demand-forecasting-ml/

# codecommit + parameter-store + workload
# CONFIG=globalbank-prod-c001-us-west-2-demand-forecasting-ml-codecommit-standalone-ssm-workload.yaml
# STACK_NAME=globalbank-prod-c001-us-west-2-demand-fc-rt-ml-stack
# SSM_PATH=/ml/globalbank-prod-c001-us-west-2-demand-fc-rt-ml/

# codecommit + direct
# CONFIG=globalbank-prod-c001-us-west-2-demand-forecasting-ml-codecommit-standalone-direct.yaml
# STACK_NAME=globalbank-prod-c001-us-west-2-demand-forecasting-ml-stack
# SSM_PATH=/ml/globalbank-prod-c001-us-west-2-demand-forecasting-ml/

# codecommit + direct + route tables
# CONFIG=globalbank-prod-c001-us-west-2-demand-forecasting-ml-codecommit-standalone-direct-rtb.yaml
# STACK_NAME=globalbank-prod-c001-us-west-2-demand-forecasting-ml-stack
# SSM_PATH=/ml/globalbank-prod-c001-us-west-2-demand-forecasting-ml/

# s3 + parameter-store
# CONFIG=globalbank-prod-c001-us-west-2-demand-forecasting-ml-s3-standalone-ssm.yaml
# STACK_NAME=globalbank-prod-c001-us-west-2-demand-forecasting-ml-stack
# SSM_PATH=/ml/globalbank-prod-c001-us-west-2-demand-forecasting-ml/

# s3 + direct
# CONFIG=globalbank-prod-c001-us-west-2-demand-forecasting-ml-s3-standalone-direct.yaml
# STACK_NAME=globalbank-prod-c001-us-west-2-demand-forecasting-ml-stack
# SSM_PATH=/ml/globalbank-prod-c001-us-west-2-demand-forecasting-ml/

---

Commands

validate-config

docker run --rm \
  -v ~/.aws:/home/mluser/.aws:ro \
  -v $(pwd)/ml/configs:/app/configs:ro \
  -v $(pwd)/ml/reports:/app/reports \
  ml-provisioner:enterprise \
  -con $CONFIG \
  -act validate-config

list-products

docker run --rm \
  -v ~/.aws:/home/mluser/.aws:ro \
  -v $(pwd)/ml/configs:/app/configs:ro \
  -v $(pwd)/ml/reports:/app/reports \
  ml-provisioner:enterprise \
  -con $CONFIG \
  -act list-products

show-product

docker run --rm \
  -v ~/.aws:/home/mluser/.aws:ro \
  -v $(pwd)/ml/configs:/app/configs:ro \
  -v $(pwd)/ml/reports:/app/reports \
  ml-provisioner:enterprise \
  -con $CONFIG \
  -act show-product

create-policy

docker run --rm \
  -v ~/.aws:/home/mluser/.aws:ro \
  -v $(pwd)/ml/configs:/app/configs:ro \
  -v $(pwd)/ml/policies:/app/policies \
  -v $(pwd)/ml/reports:/app/reports \
  ml-provisioner:enterprise \
  -con $CONFIG \
  -act create-policy

create-prov-template

docker run --rm \
  -v ~/.aws:/home/mluser/.aws:ro \
  -v $(pwd)/ml/configs:/app/configs:ro \
  -v $(pwd)/ml/templates:/app/templates \
  -v $(pwd)/ml/reports:/app/reports \
  ml-provisioner:enterprise \
  -con $CONFIG \
  -act create-prov-template

validate-prov-template

docker run --rm \
  -v ~/.aws:/home/mluser/.aws:ro \
  -v $(pwd)/ml/configs:/app/configs:ro \
  -v $(pwd)/ml/templates:/app/templates \
  -v $(pwd)/ml/reports:/app/reports \
  ml-provisioner:enterprise \
  -con $CONFIG \
  -act validate-prov-template

create-review-report

docker run --rm \
  -v ~/.aws:/home/mluser/.aws:ro \
  -v $(pwd)/ml/configs:/app/configs:ro \
  -v $(pwd)/ml/templates:/app/templates \
  -v $(pwd)/ml/reports:/app/reports \
  ml-provisioner:enterprise \
  -con $CONFIG \
  -act create-review-report

test-deploy (optional — recommended)

Deploys a temporary stack with a random suffix to validate the template before the real deployment. The test stack must be deleted before running deploy-product. For the direct-rtb scenario, see the note about route table conflicts in codecommit-standalone-direct-rtb_test.md.

docker run --rm \
  -v ~/.aws:/home/mluser/.aws:ro \
  -v $(pwd)/ml/configs:/app/configs:ro \
  -v $(pwd)/ml/reports:/app/reports \
  ml-provisioner:enterprise \
  -con $CONFIG \
  -act test-deploy

delete test stack (required if test-deploy was run)

Replace <test-stack-name> with the stack name printed by the test-deploy output above.

aws cloudformation delete-stack \
  --stack-name <test-stack-name> \
  --region us-west-2

aws cloudformation wait stack-delete-complete \
  --stack-name <test-stack-name> \
  --region us-west-2

deploy-product

docker run --rm \
  -v ~/.aws:/home/mluser/.aws:ro \
  -v $(pwd)/ml/configs:/app/configs:ro \
  -v $(pwd)/ml/templates:/app/templates \
  -v $(pwd)/ml/reports:/app/reports \
  ml-provisioner:enterprise \
  -con $CONFIG \
  -act deploy-product --force

show-changes (optional)

docker run --rm \
  -v ~/.aws:/home/mluser/.aws:ro \
  -v $(pwd)/ml/configs:/app/configs:ro \
  -v $(pwd)/ml/templates:/app/templates \
  -v $(pwd)/ml/reports:/app/reports \
  ml-provisioner:enterprise \
  -con $CONFIG \
  -act show-changes

check-drift (optional)

docker run --rm \
  -v ~/.aws:/home/mluser/.aws:ro \
  -v $(pwd)/ml/configs:/app/configs:ro \
  -v $(pwd)/ml/reports:/app/reports \
  ml-provisioner:enterprise \
  -con $CONFIG \
  -act check-drift

delete-product

docker run --rm \
  -v ~/.aws:/home/mluser/.aws:ro \
  -v $(pwd)/ml/configs:/app/configs:ro \
  -v $(pwd)/ml/reports:/app/reports \
  ml-provisioner:enterprise \
  -con $CONFIG \
  -act delete-product --force

---

Verify

List all provisioned resources

aws cloudformation describe-stack-resources \
  --stack-name $STACK_NAME \
  --region us-west-2 \
  --query "StackResources[*].[ResourceType,PhysicalResourceId]" \
  --output table

List all SSM parameters

aws ssm get-parameters-by-path \
  --path $SSM_PATH \
  --recursive \
  --region us-west-2 \
  --query "Parameters[*].Name" \
  --output table