为何EventBridge规则无法匹配SageMaker模型包组新增版本事件？

问题背景 #

想要创建EventBridge规则，检测名为WineQualityPackageGroup-2的SageMaker模型包组中新增状态为PendingManualApproval的模型版本，配置的事件模式如下：

{"source": ["aws.sagemaker"],"detail-type": ["SageMaker Model Package Group State Change"],"resources": ["arn:aws:sagemaker:eu-west-2:XXXXXXXXXXXXXXX:model-package-group/WineQualityPackageGroup-2"],"detail": {"eventSource": ["sagemaker.amazonaws.com"],"eventName": ["CreateModelPackage"],"requestParameters": {"modelPackageGroupName": ["WineQualityPackageGroup-2"],"modelPackageStatus": ["PendingManualApproval"]}}}

运行ML训练流水线注册新版本时，规则未触发。查看CloudTrail日志存在CreateModelPackage记录，CloudWatch日志中的对应事件如下：

{"version": "0","id": "9bc9e0a0-e4e8-0b2f-c3b1-d7074b281af1","detail-type": "SageMaker Model Package State Change","source": "aws.sagemaker","account": "XXXXXXXXXXXX","time": "2023-10-10T15:33:30Z","region": "eu-west-2","resources": ["arn:aws:sagemaker:eu-west-2:XXXXXXXXXXXX:model-package/WineQualityPackageGroup-2/7"],"detail": {"ModelPackageName": "WineQualityPackageGroup-2/7","ModelPackageGroupName": "WineQualityPackageGroup-2","ModelPackageVersion": 7,"ModelPackageArn": "arn:aws:sagemaker:eu-west-2:XXXXXXXXXXXX:model-package/WineQualityPackageGroup-2/7","ModelPackageDescription": null,"CreationTime": 1696952010090,"InferenceSpecification": {"Containers": [{"ContainerHostname": null,"Image": "XXXXXXXXXXXX.dkr.ecr.eu-west-2.amazonaws.com/sagemaker-scikit-learn:1.2-1-cpu-py3","ImageDigest": "XXXXXXXXXXXX","ModelDataUrl": "s3://XXXXXXXXXXXX/WineQualityPipeline-ModelBuild/sovgi0o5mv4j/WineQualityPredict/RandomForestClassifier/pipelines-sovgi0o5mv4j-TrainingRandomForest-mdiXKAFvui/output/model.tar.gz","ProductId": null,"Environment": null,"ModelInput": null,"Framework": null,"FrameworkVersion": null,"NearestModelName": null,"SamplePayloadUrl": null,"AdditionalS3DataSource": null}],"SupportedTransformInstanceTypes": ["ml.m5.xlarge"],"SupportedRealtimeInferenceInstanceTypes": ["ml.t2.medium","ml.m5.xlarge"],"SupportedContentTypes": ["text/csv"],"SupportedResponseMIMETypes": ["text/csv"]},"SourceAlgorithmSpecification": null,"ValidationSpecification": null,"ModelPackageStatus": "Created","ModelPackageStatusDetails": {"ValidationStatuses": [],"ImageScanStatuses": []},"CertifyForMarketplace": false,"ModelApprovalStatus": "PendingManualApproval","CreatedBy": {"UserProfileArn": null,"UserProfileName": null,"DomainId": null,"IamIdentity": {"Arn": "arn:aws:sts::XXXXXXXXXXXX:assumed-role/SageMakerExecutionRole-ModelBuild-CICD/sagemaker-pipeline-sovgi0o5mv4j-WineQualityRegisterR","PrincipalId": "XXXXXXXXXXXX:sagemaker-pipeline-sovgi0o5mv4j-WineQualityRegisterR","SourceIdentity": null}},"MetadataProperties": null,"ModelMetrics": null,"DeploymentSpecification": null,"LastModifiedTime": null,"LastModifiedBy": {"UserProfileArn": null,"UserProfileName": null,"DomainId": null,"IamIdentity": {"Arn": "arn:aws:sts::XXXXXXXXXXXX:assumed-role/SageMakerExecutionRole-ModelBuild-CICD/sagemaker-pipeline-sovgi0o5mv4j-WineQualityRegisterR","PrincipalId": "XXXXXXXXXXXX:sagemaker-pipeline-sovgi0o5mv4j-WineQualityRegisterR","SourceIdentity": null}},"ApprovalDescription": null,"Domain": null,"Task": null,"SamplePayloadUrl": null,"SamplePayloadContentType": null,"CustomerMetadataProperties": null,"DriftCheckBaselines": null,"AdditionalInferenceSpecifications": null,"SkipModelValidation": null}}

不匹配原因 #

事件模式失效的核心是混淆了SageMaker原生EventBridge事件与CloudTrail事件的结构，具体错误点：

• detail-type错误：指定的SageMaker Model Package Group State Change不存在，实际触发的事件类型是SageMaker Model Package State Change（针对单个模型包版本的状态变化，而非模型包组本身）。
• resources字段不匹配：配置的是模型包组ARN，但实际事件的resources字段是单个模型包版本的ARN（每个版本ARN不同，无法提前指定）。
• detail字段结构错误：使用了CloudTrail事件特有的eventSource、eventName、requestParameters字段，但SageMaker原生EventBridge事件的detail直接包含ModelPackageGroupName、ModelApprovalStatus等属性；同时错误使用modelPackageStatus字段，实际控制审批状态的是ModelApprovalStatus。

修正后的事件模式 #

{
  "source": ["aws.sagemaker"],
  "detail-type": ["SageMaker Model Package State Change"],
  "detail": {
    "ModelPackageGroupName": ["WineQualityPackageGroup-2"],
    "ModelApprovalStatus": ["PendingManualApproval"]
  }
}

该模式直接匹配SageMaker原生事件结构，通过模型包组名称和审批状态过滤，无需绑定特定ARN，确保目标组内所有状态为PendingManualApproval的新模型包版本都会触发规则。

内容的提问来源于stack exchange，提问作者Francisco Parrilla