workforces

Creates, updates, deletes, gets or lists a workforces resource.

Overview

Name	`workforces`
Type	Resource
Id	`aws.sagemaker.workforces`

Fields

The following fields are returned by SELECT queries:

describe_workforce
list_workforces

Name	Datatype	Description
`cognito_config`	`object`	The configuration of an Amazon Cognito workforce. A single Cognito workforce is created using and corresponds to a single Amazon Cognito user pool.
`create_date`	`string (date-time)`	The date that the workforce is created.
`failure_reason`	`string`	The reason your workforce failed. (pattern: <code>.+</code>)
`ip_address_type`	`string`	The IP address type you specify - either IPv4 only or dualstack (IPv4 and IPv6) - to support your labeling workforce. (ipv4, dualstack)
`last_updated_date`	`string (date-time)`	The most recent date that UpdateWorkforce was used to successfully add one or more IP address ranges (CIDRs) to a private workforce's allow list.
`oidc_config`	`object`	The configuration of an OIDC Identity Provider (IdP) private workforce.
`source_ip_config`	`object`	A list of IP address ranges (CIDRs). Used to create an allow list of IP addresses for a private workforce. Workers will only be able to log in to their worker portal from an IP address within this range. By default, a workforce isn't restricted to specific IP addresses.
`status`	`string`	The status of your workforce. (Initializing, Updating, Deleting, Failed, Active)
`sub_domain`	`string`	The subdomain for your OIDC Identity Provider.
`workforce_arn`	`string`	The Amazon Resource Name (ARN) of the private workforce. (pattern: <code>arn:aws[a-z-]:sagemaker:[a-z0-9-]:[0-9]{12}:workforce/.*</code>)
`workforce_name`	`string`	The name of the private workforce. (pattern: <code>[a-zA-Z0-9]([a-zA-Z0-9-]){0,62}</code>)
`workforce_vpc_config`	`object`	The configuration of a VPC workforce.

Name	Datatype	Description
`cognito_config`	`object`	The configuration of an Amazon Cognito workforce. A single Cognito workforce is created using and corresponds to a single Amazon Cognito user pool.
`create_date`	`string (date-time)`	The date that the workforce is created.
`failure_reason`	`string`	The reason your workforce failed. (pattern: <code>.+</code>)
`ip_address_type`	`string`	The IP address type you specify - either IPv4 only or dualstack (IPv4 and IPv6) - to support your labeling workforce. (ipv4, dualstack)
`last_updated_date`	`string (date-time)`	The most recent date that UpdateWorkforce was used to successfully add one or more IP address ranges (CIDRs) to a private workforce's allow list.
`oidc_config`	`object`	The configuration of an OIDC Identity Provider (IdP) private workforce.
`source_ip_config`	`object`	A list of IP address ranges (CIDRs). Used to create an allow list of IP addresses for a private workforce. Workers will only be able to log in to their worker portal from an IP address within this range. By default, a workforce isn't restricted to specific IP addresses.
`status`	`string`	The status of your workforce. (Initializing, Updating, Deleting, Failed, Active)
`sub_domain`	`string`	The subdomain for your OIDC Identity Provider.
`workforce_arn`	`string`	The Amazon Resource Name (ARN) of the private workforce. (pattern: <code>arn:aws[a-z-]:sagemaker:[a-z0-9-]:[0-9]{12}:workforce/.*</code>)
`workforce_name`	`string`	The name of the private workforce. (pattern: <code>[a-zA-Z0-9]([a-zA-Z0-9-]){0,62}</code>)
`workforce_vpc_config`	`object`	The configuration of a VPC workforce.

Methods

The following methods are available for this resource:

Name	Accessible by	Required Params	Description
`describe_workforce`	`select`	`region`	Lists private workforce information, including workforce name, Amazon Resource Name (ARN), and, if applicable, allowed IP address ranges (CIDRs). Allowable IP address ranges are the IP addresses that workers can use to access tasks. This operation applies only to private workforces.
`list_workforces`	`select`	`region`	Use this operation to list all private and vendor workforces in an Amazon Web Services Region. Note that you can only have one private workforce per Amazon Web Services Region.
`create_workforce`	`insert`	`region`, `WorkforceName`	Use this operation to create a workforce. This operation will return an error if a workforce already exists in the Amazon Web Services Region that you specify. You can only create one workforce in each Amazon Web Services Region per Amazon Web Services account. If you want to create a new workforce in an Amazon Web Services Region where a workforce already exists, use the DeleteWorkforce API operation to delete the existing workforce and then use CreateWorkforce to create a new workforce. To create a private workforce using Amazon Cognito, you must specify a Cognito user pool in CognitoConfig. You can also create an Amazon Cognito workforce using the Amazon SageMaker console. For more information, see Create a Private Workforce (Amazon Cognito). To create a private workforce using your own OIDC Identity Provider (IdP), specify your IdP configuration in OidcConfig. Your OIDC IdP must support groups because groups are used by Ground Truth and Amazon A2I to create work teams. For more information, see Create a Private Workforce (OIDC IdP).
`update_workforce`	`update`	`region`, `WorkforceName`	Use this operation to update your workforce. You can use this operation to require that workers use specific IP addresses to work on tasks and to update your OpenID Connect (OIDC) Identity Provider (IdP) workforce configuration. The worker portal is now supported in VPC and public internet. Use SourceIpConfig to restrict worker access to tasks to a specific range of IP addresses. You specify allowed IP addresses by creating a list of up to ten CIDRs. By default, a workforce isn't restricted to specific IP addresses. If you specify a range of IP addresses, workers who attempt to access tasks using any IP address outside the specified range are denied and get a Not Found error message on the worker portal. To restrict public internet access for all workers, configure the SourceIpConfig CIDR value. For example, when using SourceIpConfig with an IpAddressType of IPv4, you can restrict access to the IPv4 CIDR block "10.0.0.0/16". When using an IpAddressType of dualstack, you can specify both the IPv4 and IPv6 CIDR blocks, such as "10.0.0.0/16" for IPv4 only, "2001:db8🔢1a00::/56" for IPv6 only, or "10.0.0.0/16" and "2001:db8🔢1a00::/56" for dual stack. Amazon SageMaker does not support Source Ip restriction for worker portals in VPC. Use OidcConfig to update the configuration of a workforce created using your own OIDC IdP. You can only update your OIDC IdP configuration when there are no work teams associated with your workforce. You can delete work teams using the DeleteWorkteam operation. After restricting access to a range of IP addresses or updating your OIDC IdP configuration with this operation, you can view details about your update workforce using the DescribeWorkforce operation. This operation only applies to private workforces.
`delete_workforce`	`delete`	`region`	Use this operation to delete a workforce. If you want to create a new workforce in an Amazon Web Services Region where a workforce already exists, use this operation to delete the existing workforce and then use CreateWorkforce to create a new workforce. If a private workforce contains one or more work teams, you must use the DeleteWorkteam operation to delete all work teams before you delete the workforce. If you try to delete a workforce that contains one or more work teams, you will receive a ResourceInUse error.

Parameters

Parameters can be passed in the WHERE clause of a query. Check the Methods section to see which parameters are required or optional for each operation.

Name	Datatype	Description
`region`	`string`	AWS region (default: us-east-1)

`SELECT` examples

describe_workforce
list_workforces

Lists private workforce information, including workforce name, Amazon Resource Name (ARN), and, if applicable, allowed IP address ranges (CIDRs). Allowable IP address ranges are the IP addresses that workers can use to access tasks. This operation applies only to private workforces.

SELECT
cognito_config,
create_date,
failure_reason,
ip_address_type,
last_updated_date,
oidc_config,
source_ip_config,
status,
sub_domain,
workforce_arn,
workforce_name,
workforce_vpc_config
FROM aws.sagemaker.workforces
WHERE region = '{{ region }}' -- required
;

Use this operation to list all private and vendor workforces in an Amazon Web Services Region. Note that you can only have one private workforce per Amazon Web Services Region.

SELECT
cognito_config,
create_date,
failure_reason,
ip_address_type,
last_updated_date,
oidc_config,
source_ip_config,
status,
sub_domain,
workforce_arn,
workforce_name,
workforce_vpc_config
FROM aws.sagemaker.workforces
WHERE region = '{{ region }}' -- required
;

`INSERT` examples

create_workforce
Manifest

Use this operation to create a workforce. This operation will return an error if a workforce already exists in the Amazon Web Services Region that you specify. You can only create one workforce in each Amazon Web Services Region per Amazon Web Services account. If you want to create a new workforce in an Amazon Web Services Region where a workforce already exists, use the DeleteWorkforce API operation to delete the existing workforce and then use CreateWorkforce to create a new workforce. To create a private workforce using Amazon Cognito, you must specify a Cognito user pool in CognitoConfig. You can also create an Amazon Cognito workforce using the Amazon SageMaker console. For more information, see Create a Private Workforce (Amazon Cognito). To create a private workforce using your own OIDC Identity Provider (IdP), specify your IdP configuration in OidcConfig. Your OIDC IdP must support groups because groups are used by Ground Truth and Amazon A2I to create work teams. For more information, see Create a Private Workforce (OIDC IdP).

INSERT INTO aws.sagemaker.workforces (
CognitoConfig,
OidcConfig,
SourceIpConfig,
WorkforceName,
Tags,
WorkforceVpcConfig,
IpAddressType,
region
)
SELECT 
'{{ CognitoConfig }}',
'{{ OidcConfig }}',
'{{ SourceIpConfig }}',
'{{ WorkforceName }}' /* required */,
'{{ Tags }}',
'{{ WorkforceVpcConfig }}',
'{{ IpAddressType }}',
'{{ region }}'
RETURNING
workforce_arn
;

# Description fields are for documentation purposes
- name: workforces
props:
  - name: region
    value: "{{ region }}"
    description: Required parameter for the workforces resource.
  - name: CognitoConfig
    description: |
      Use this parameter to configure an Amazon Cognito private workforce. A single Cognito workforce is created using and corresponds to a single Amazon Cognito user pool. Do not use OidcConfig if you specify values for CognitoConfig.
    value:
      UserPool: "{{ UserPool }}"
      ClientId: "{{ ClientId }}"
  - name: OidcConfig
    description: |
      Use this parameter to configure a private workforce using your own OIDC Identity Provider. Do not use CognitoConfig if you specify values for OidcConfig.
    value:
      ClientId: "{{ ClientId }}"
      ClientSecret: "{{ ClientSecret }}"
      Issuer: "{{ Issuer }}"
      AuthorizationEndpoint: "{{ AuthorizationEndpoint }}"
      TokenEndpoint: "{{ TokenEndpoint }}"
      UserInfoEndpoint: "{{ UserInfoEndpoint }}"
      LogoutEndpoint: "{{ LogoutEndpoint }}"
      JwksUri: "{{ JwksUri }}"
      Scope: "{{ Scope }}"
      AuthenticationRequestExtraParams: "{{ AuthenticationRequestExtraParams }}"
  - name: SourceIpConfig
    description: |
      A list of IP address ranges (CIDRs). Used to create an allow list of IP addresses for a private workforce. Workers will only be able to log in to their worker portal from an IP address within this range. By default, a workforce isn't restricted to specific IP addresses.
    value:
      Cidrs:
        - "{{ Cidrs }}"
  - name: WorkforceName
    value: "{{ WorkforceName }}"
    description: |
      The name of the private workforce.
  - name: Tags
    description: |
      An array of key-value pairs that contain metadata to help you categorize and organize our workforce. Each tag consists of a key and a value, both of which you define.
    value:
      - Key: "{{ Key }}"
        Value: "{{ Value }}"
  - name: WorkforceVpcConfig
    description: |
      Use this parameter to configure a workforce using VPC.
    value:
      VpcId: "{{ VpcId }}"
      SecurityGroupIds:
        - "{{ SecurityGroupIds }}"
      Subnets:
        - "{{ Subnets }}"
  - name: IpAddressType
    value: "{{ IpAddressType }}"
    description: |
      Use this parameter to specify whether you want IPv4 only or dualstack (IPv4 and IPv6) to support your labeling workforce.
    valid_values: ['ipv4', 'dualstack']

`UPDATE` examples

update_workforce

Use this operation to update your workforce. You can use this operation to require that workers use specific IP addresses to work on tasks and to update your OpenID Connect (OIDC) Identity Provider (IdP) workforce configuration. The worker portal is now supported in VPC and public internet. Use SourceIpConfig to restrict worker access to tasks to a specific range of IP addresses. You specify allowed IP addresses by creating a list of up to ten CIDRs. By default, a workforce isn't restricted to specific IP addresses. If you specify a range of IP addresses, workers who attempt to access tasks using any IP address outside the specified range are denied and get a Not Found error message on the worker portal. To restrict public internet access for all workers, configure the SourceIpConfig CIDR value. For example, when using SourceIpConfig with an IpAddressType of IPv4, you can restrict access to the IPv4 CIDR block "10.0.0.0/16". When using an IpAddressType of dualstack, you can specify both the IPv4 and IPv6 CIDR blocks, such as "10.0.0.0/16" for IPv4 only, "2001:db8🔢1a00::/56" for IPv6 only, or "10.0.0.0/16" and "2001:db8🔢1a00::/56" for dual stack. Amazon SageMaker does not support Source Ip restriction for worker portals in VPC. Use OidcConfig to update the configuration of a workforce created using your own OIDC IdP. You can only update your OIDC IdP configuration when there are no work teams associated with your workforce. You can delete work teams using the DeleteWorkteam operation. After restricting access to a range of IP addresses or updating your OIDC IdP configuration with this operation, you can view details about your update workforce using the DescribeWorkforce operation. This operation only applies to private workforces.

UPDATE aws.sagemaker.workforces
SET 
WorkforceName = '{{ WorkforceName }}',
SourceIpConfig = '{{ SourceIpConfig }}',
OidcConfig = '{{ OidcConfig }}',
WorkforceVpcConfig = '{{ WorkforceVpcConfig }}',
IpAddressType = '{{ IpAddressType }}'
WHERE 
region = '{{ region }}' --required
AND WorkforceName = '{{ WorkforceName }}' --required
RETURNING
workforce;

`DELETE` examples

delete_workforce

Use this operation to delete a workforce. If you want to create a new workforce in an Amazon Web Services Region where a workforce already exists, use this operation to delete the existing workforce and then use CreateWorkforce to create a new workforce. If a private workforce contains one or more work teams, you must use the DeleteWorkteam operation to delete all work teams before you delete the workforce. If you try to delete a workforce that contains one or more work teams, you will receive a ResourceInUse error.

DELETE FROM aws.sagemaker.workforces
WHERE region = '{{ region }}' --required
;

Overview​

Fields​

Methods​

Parameters​

SELECT examples​

INSERT examples​

UPDATE examples​

DELETE examples​