feat: Add sagemaker_image and sagemaker_image_info - #54

Code Review Findings

1. delete_image doesn't wait for completion (sagemaker_image.py:283)
delete_image returns immediately without honoring the wait parameter (default true). SageMaker's DeleteImage is async, so chaining a create after delete can race against the ongoing deletion and fail.

2. Docs/code mismatch on wait for delete (sagemaker_image_module.rst:366)
The RST docs say wait applies to "create, update, or delete" but the module source and DOCUMENTATION string only say "create or update". Either add wait-on-delete support or fix the docs.

3. Info module fails on missing image (sagemaker_image_info.py:145)
sagemaker_image_info calls fail_json when an image isn't found. Standard Ansible _info convention (and sibling sagemaker_code_repository_info) returns an empty list instead, which supports lookup-before-act patterns without ignore_errors.

4. Unnecessary list_tags API call (sagemaker_image.py:256)
update_image always calls list_tags even when the user didn't pass tags. Guard with if module.params.get("tags") is not None to skip the wasted roundtrip.

Thank you for the PR @JanLikar ! I'm somewhat new to this team and not as familiar with sagemaker as others so I conducted a review with Claude. I posted those findings in my previous comment. I hope they are helpful!

Follow-up: image_deleted waiter workaround

Reviewed the upstream issue (boto/botocore#3782) and the reproduction gist. The root cause is clear: botocore's ImageDeleted waiter expects ResourceNotFoundException but SageMaker returns ResourceNotFound. The custom _wait_for_image_deletion polling loop is the right approach here.

The implementation in the latest push looks good — one suggestion for parity with the upstream waiter:

Check for DELETE_FAILED during polling. The botocore waiter treats DELETE_FAILED as a failure condition, but the custom loop doesn't — it would keep polling until timeout. Consider adding an early exit:

def _wait_for_image_deletion(
    client,
    module: AnsibleAWSModule,
    image_name: str,
    delay: int,
    max_attempts: int,
) -> None:
    for attempt in range(max_attempts):
        try:
            image = describe_image(client, image_name)
            if image is None:
                return
            if image.get("ImageStatus") == "DELETE_FAILED":
                module.fail_json(
                    msg=f"SageMaker Image {image_name} entered DELETE_FAILED state.",
                )
        except (
            is_boto3_error_code("ResourceNotFound"),
            is_boto3_error_code("ResourceNotFoundException"),
        ):
            return

        if attempt < max_attempts - 1:
            time.sleep(delay)

    module.fail_json(
        msg=(
            f"Timeout waiting for SageMaker Image {image_name} to be deleted. "
            "Polling did not confirm deletion within the timeout period."
        )
    )

Minor note: since describe_image already catches ResourceNotFound and returns None, the except block here would only fire for ResourceNotFoundException — which is defensive but harmless. When botocore ships the upstream fix, this function can be removed and the standard waiter path in _wait_for_image_status will work.

Quality Gate passed

Issues
20 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud