feat(sagemaker-alpha): add Pipeline import methods for existing SageMaker Pipelines

[pahud]

Issue # (if applicable)

Closes #35220.

Reason for this change

Users need the ability to import existing SageMaker Pipelines into their CDK applications to integrate with other AWS services like EventBridge Scheduler. This addresses a common use case where data scientists develop and manage ML pipelines outside of CDK, but infrastructure teams need to schedule and orchestrate these pipelines as part of larger workflows.

The current @aws-cdk/aws-sagemaker-alpha package had an IPipeline interface but no concrete implementation with import methods, making it impossible to reference existing pipelines in CDK applications.

Description of changes

This change adds import-only Pipeline functionality to the @aws-cdk/aws-sagemaker-alpha package. Note: This construct cannot create new SageMaker Pipelines - it only imports existing ones for infrastructure integration purposes.

• Pipeline Class: New Pipeline class implementing the IPipeline interface from aws-cdk-lib/aws-sagemaker with static import methods
• Import Methods:
  • Pipeline.fromPipelineArn() - Import pipeline by ARN (supports cross-account/region)
  • Pipeline.fromPipelineName() - Import pipeline by name (same account/region as stack)
  • Pipeline.fromPipelineAttributes() - Import with custom attributes for advanced scenarios
• Pipeline Name Validation: AWS-compliant validation for pipeline names (1-256 chars, alphanumeric with hyphens, no consecutive hyphens)
• IAM Integration: grantStartPipelineExecution() method for proper permission management
• EventBridge Scheduler Integration: Full compatibility with SageMakerStartPipelineExecution target by implementing the standard IPipeline interface
• Cross-account Support: Custom account/region parameters for importing pipelines from different environments
• Exported Utilities: The validatePipelineName() function is exported for reuse by other constructs and user validation

The implementation follows established CDK patterns used by other AWS services (S3, Lambda, IAM) for consistency and familiarity.

Key design decisions:

• Import-only approach: This L2 construct cannot create new SageMaker Pipelines - it only imports existing ones. SageMaker Pipelines are complex ML workflows with intricate step definitions, dependencies, and configurations that are best developed using SageMaker Studio, the SageMaker Python SDK, or other ML-focused tools. The constructor throws an error if instantiated directly, guiding users to use the static import methods instead.
• Interface compatibility: Uses IPipeline interface from the stable aws-cdk-lib/aws-sagemaker package instead of duplicating it in the alpha package. This ensures compatibility with existing CDK services (like EventBridge Scheduler targets) and prevents interface conflicts when both packages are used together.
• Alpha package location: New SageMaker L2 constructs belong in the experimental alpha package
• Comprehensive validation: Pipeline names are validated against AWS requirements to prevent runtime errors. The validatePipelineName() function is also exported as a utility for other constructs and user validation.
• Flexible import options: Multiple import methods support different use cases and deployment patterns
• Separation of concerns: Data scientists manage pipeline development and iteration using ML tools, while infrastructure teams handle scheduling, monitoring, and integration via CDK

Describe any new or updated permissions being added

IAM Permissions: The grantStartPipelineExecution() method grants the sagemaker:StartPipelineExecution permission on the specific pipeline resource. This is the minimal permission required for EventBridge Scheduler and other services to trigger pipeline executions.

No additional resource access patterns are introduced - this follows the standard CDK grant pattern used throughout the framework.

Description of how you validated changes

Unit Tests: 20 comprehensive unit tests covering all functionality:

• Import methods (fromPipelineArn, fromPipelineName, fromPipelineAttributes)
• Pipeline name validation (valid and invalid formats)
• Cross-account/region support
• IAM grant methods
• EventBridge Scheduler integration
• Error handling and edge cases

Integration Test: Real-world deployment test (integ.pipeline-import.ts) that:

• Creates supporting AWS resources (S3 buckets, IAM roles)
• Creates a minimal SageMaker Pipeline using L1 constructs
• Tests both import methods (fromPipelineArn and fromPipelineName)
• Validates IAM permission grants
• Verifies EventBridge Scheduler compatibility

Checklist

• My code adheres to the CONTRIBUTING GUIDE and DESIGN GUIDELINES

---

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license

[aws-cdk-automation]

(This review is outdated)

✅ Updated pull request passes all PRLinter validations. Dismissing previous PRLinter review.

[pahud]

Not sure if we should duplicate the IPipeline in the alpha module. Tentatively import it from stable module for now. Please advise if we should duplicate instead.

[lorenzwalthert]

@pahud what's stopping this PR to be reviewed and merged? I don't understand the processes here. If this isn't merged and released soon, I'll have to find a workaround.

[pahud]

@lorenzwalthert this PR has been in the reviewing backlog of the team. I'll bring this up to the team for inputs here. Thank you for the callout.