hf-cloud-sagemaker-iam-preflight

Topics in the source

• SageMaker IAM Preflight
• Running the helpers (cross-platform)
• Order of operations
• Step 1 — Did the user provide a role?
• Step 2 — Discover existing roles
• Step 3 — Create, only if discovery found nothing
• What "validated" means
• Minimum permissions

Every SageMaker resource needs an execution role — the IAM role SageMaker assumes to read model artifacts from S3, pull serving containers from ECR, and write logs. Most deployments fail here because the script tried to create a new role without checking if a usable one already existed, then blew up because the caller is an SSO principal. This skill encodes the right order: discover, validate, only create if necessary. The helpers are Python so they run identically on Windows, macOS, and Linux: Run them from the shell where the AWS CLI already works — i.e. wherever aws sts get-caller-identity succeeds. The script shells out to that same aws binary and inherits the shell's profile, region, SSO session, proxy, and credential chain. Windows / WSL / Git Bash caveat. Do not invoke these through a Bash shim (WSL, Git Bash, MSYS) on Windows. Those Bash environments frequently do not share the Windows AWS config, credentials, SSO sessions, environment variables, or proxy settings — so aws sts get-caller-identity fails inside Bash even when it works natively in PowerShell. (This is exactly why the old .sh helpers failed on Windows and were replaced with Python.) If you're in PowerShell, run

This is an excerpt. Refer to the complete source and its current requirements.