Weights & Biases AWS Module

IMPORTANT: You are viewing a beta version of the official module to install Weights & Biases. This new version is incompatible with earlier versions, and it is not currently meant for production use. Please contact your Customer Success Manager for details before using.

This is a Terraform module for provisioning a Weights & Biases Cluster on AWS. Weights & Biases Local is our self-hosted distribution of wandb.ai. It offers enterprises a private instance of the Weights & Biases application, with no resource limits and with additional enterprise-grade architectural features like audit logging and SAML single sign-on.

About This Module

Pre-requisites

This module is intended to run in an AWS account with minimal preparation, however it does have the following pre-requisites:

Terrafom version >= 1

Credentials / Permissions

AWS Services Used

• AWS Identity & Access Management (IAM)
• AWS Key Management System (KMS)
• Amazon Aurora MySQL
• Amazon VPC
• Amazon S3
• Amazon Route53
• Amazon Certificate Manager (ACM)
• Amazon Elastic Loadbalancing (ALB)
• Amazon Secrets Manager

Public Hosted Zone

If you are managing DNS via AWS Route53 the hosted zone entry is created automatically as part of your domain management.

If you're managing DNS outside of Route53, you will need to:

1. Create a Route53 zone name {subdomain}.{domain} (e.g test.wandb.ai)
2. Create a NS record in your parent system and point it to the newly created Route53
3. Enable the external_dns option in this module

You can learn more about creating a hosted zone for a subdomain, which you will need to do for the subdomain you are planning to use for your Weights & Biases installation. To create this hosted zone with Terraform, use the aws_route53_zone resource.

ACM Certificate

While this is not required, it is recommend to already have an existing ACM certification. Certificate validation can take up two hours, causing timeouts during module apply if the cert is generated as one of the resources contained in the module.

How to Use This Module

• Ensure account meets module pre-requisites from above.

• Please note that while some resources are individually and uniquely tagged, all common tags are expected to be configured within the AWS provider as shown in the example code snippet below.

• Create a Terraform configuration that pulls in this module and specifies values of the required variables:

provider "aws" {
  region = "<your AWS region>"
  default_tags {
    tags = var.common_tags
  }
}

module "wandb" {
  source    = "<filepath to cloned module directory>"
  namespace = "<prefix for naming AWS resources>"
}

• Run terraform init and terraform apply

Examples

We have included documentation and reference examples for additional common installation scenarios for Weights & Biases, as well as examples for supporting resources that lack official modules.

• Private Access Only
• Private Existing Network
• Public External DNS
• Public Route 53 DNS

A note on updating EKS cluster version

Users can update the EKS cluster version to the latest version offered by AWS. This can be done using the environment variable eks_cluster_version. Note that, cluster and nodegroup version updates can only be done in increments of one version at a time. For example, if your current cluster version is 1.21 and the latest version available is 1.25 - you'd need to:

1. update the cluster version in the app_eks module from 1.21 to 1.22
2. run terraform apply
3. update the cluster version to 1.23
4. run terraform apply
5. update the cluster version to 1.24 ...and so on and so forth.

Upgrades must be executed in step-wise fashion from one version to the next. You cannot skip versions when upgrading EKS.

Requirements

Name	Version
terraform	>= 1.0
aws	~> 4.6
kubernetes	~> 2.6

Providers

Name	Version
aws	~> 4.6

Modules

Name	Source	Version
acm	terraform-aws-modules/acm/aws	~> 3.0
app_eks	./modules/app_eks	n/a
app_lb	./modules/app_lb	n/a
database	./modules/database	n/a
file_storage	./modules/file_storage	n/a
kms	./modules/kms	n/a
networking	./modules/networking	n/a
redis	./modules/redis	n/a

Resources

Name	Type
aws_s3_bucket.file_storage	data source
aws_sqs_queue.file_storage	data source

Inputs

Name	Description	Type	Default	Required
acm_certificate_arn	The ARN of an existing ACM certificate.	string	null	no
allowed_inbound_cidr	CIDRs allowed to access wandb-server.	list(string)	n/a	yes
allowed_inbound_ipv6_cidr	CIDRs allowed to access wandb-server.	list(string)	n/a	yes
bucket_kms_key_arn	The Amazon Resource Name of the KMS key with which S3 storage bucket objects will be encrypted.	string	""	no
bucket_name	n/a	string	""	no
create_bucket	######################################### External Bucket # ######################################### Most users will not need these settings. They are ment for users who want a bucket and sqs that are in a different account.	bool	true	no
create_elasticache	Boolean indicating whether to provision an elasticache instance (true) or not (false).	bool	true	no
create_vpc	Boolean indicating whether to deploy a VPC (true) or not (false).	bool	true	no
database_binlog_format	Specifies the binlog_format value to set for the database	string	"ROW"	no
database_engine_version	Version for MySQL Auora	string	"8.0.mysql_aurora.3.03.0"	no
database_innodb_lru_scan_depth	Specifies the innodb_lru_scan_depth value to set for the database	number	128	no
database_instance_class	Instance type to use by database master instance.	string	"db.r5.large"	no
database_master_username	Specifies the master_username value to set for the database	string	"wandb"	no
database_name	Specifies the name of the database	string	"wandb_local"	no
database_performance_insights_kms_key_arn	Specifies an existing KMS key ARN to encrypt the performance insights data if performance_insights_enabled is was enabled out of band	string	n/a	yes
database_snapshot_identifier	Specifies whether or not to create this cluster from a snapshot. You can use either the name or ARN when specifying a DB cluster snapshot, or the ARN when specifying a DB snapshot	string	null	no
database_sort_buffer_size	Specifies the sort_buffer_size value to set for the database	number	67108864	no
deletion_protection	If the instance should have deletion protection enabled. The database / S3 can't be deleted when this value is set to true.	bool	true	no
domain_name	Domain for accessing the Weights & Biases UI.	string	n/a	yes
eks_cluster_version	Indicates EKS cluster version	string	"1.21"	no
eks_policy_arns	Additional IAM policy to apply to the EKS cluster	list(string)	[]	no
elasticache_node_type	The type of the redis cache node to deploy	string	"cache.t2.medium"	no
external_dns	Using external DNS. A subdomain must also be specified if this value is true.	bool	false	no
extra_fqdn	n/a	list(string)	[]	no
kms_key_alias	KMS key alias for AWS KMS Customer managed key.	string	null	no
kms_key_deletion_window	Duration in days to destroy the key after it is deleted. Must be between 7 and 30 days.	number	7	no
kms_key_policy	The policy that will define the permissions for the kms key.	string	""	no
kubernetes_instance_types	EC2 Instance type for primary node group.	list(string)	[ "m4.large" ]	no
kubernetes_map_accounts	Additional AWS account numbers to add to the aws-auth configmap.	list(string)	[]	no
kubernetes_map_roles	Additional IAM roles to add to the aws-auth configmap.	list(object({ rolearn = string username = string groups = list(string) }))	[]	no
kubernetes_map_users	Additional IAM users to add to the aws-auth configmap.	list(object({ userarn = string username = string groups = list(string) }))	[]	no
kubernetes_public_access	Indicates whether or not the Amazon EKS public API server endpoint is enabled.	bool	false	no
kubernetes_public_access_cidrs	List of CIDR blocks which can access the Amazon EKS public API server endpoint.	list(string)	[]	no
namespace	String used for prefix resources.	string	n/a	yes
network_cidr	CIDR block for VPC.	string	"10.10.0.0/16"	no
network_database_subnet_cidrs	List of private subnet CIDR ranges to create in VPC.	list(string)	[ "10.10.20.0/24", "10.10.21.0/24" ]	no
network_database_subnets	A list of the identities of the database subnetworks in which resources will be deployed.	list(string)	[]	no
network_elasticache_subnet_cidrs	List of private subnet CIDR ranges to create in VPC.	list(string)	[ "10.10.30.0/24", "10.10.31.0/24" ]	no
network_id	The identity of the VPC in which resources will be deployed.	string	""	no
network_private_subnet_cidrs	List of private subnet CIDR ranges to create in VPC.	list(string)	[ "10.10.10.0/24", "10.10.11.0/24" ]	no
network_private_subnets	A list of the identities of the private subnetworks in which resources will be deployed.	list(string)	[]	no
network_public_subnet_cidrs	List of private subnet CIDR ranges to create in VPC.	list(string)	[ "10.10.0.0/24", "10.10.1.0/24" ]	no
network_public_subnets	A list of the identities of the public subnetworks in which resources will be deployed.	list(string)	[]	no
public_access	Is this instance accessable a public domain.	bool	false	no
ssl_policy	SSL policy to use on ALB listener	string	"ELBSecurityPolicy-FS-1-2-Res-2020-10"	no
subdomain	Subdomain for accessing the Weights & Biases UI. Default creates record at Route53 Route.	string	null	no
use_internal_queue	n/a	bool	false	no
zone_id	Domain for creating the Weights & Biases subdomain on.	string	n/a	yes

Outputs

Name	Description
bucket_name	n/a
bucket_queue_name	n/a
bucket_region	n/a
cluster_id	n/a
cluster_node_role	n/a
database_connection_string	n/a
elasticache_connection_string	n/a
internal_app_port	n/a
kms_key_arn	The Amazon Resource Name of the KMS key used to encrypt data at rest.
network_id	The identity of the VPC in which resources are deployed.
network_private_subnets	The identities of the private subnetworks deployed within the VPC.
network_public_subnets	The identities of the public subnetworks deployed within the VPC.
url	The URL to the W&B application