From 32f7d0604907cc6ca7c12bedf322d296b17b35fd Mon Sep 17 00:00:00 2001 From: Jan Likar Date: Wed, 19 Aug 2026 10:03:27 +0200 Subject: [PATCH 1/2] Add SageMaker Image IAM permissions and terminator Add sagemaker:CreateImage, sagemaker:DescribeImage, sagemaker:UpdateImage, sagemaker:DeleteImage, sagemaker:ListImages, sagemaker:AddTags, sagemaker:DeleteTags, sagemaker:ListTags permissions needed for the amazon.ai sagemaker_image integration tests. Also add AmazonSageMakerFullAccess to the allowed policies for iam:AttachRolePolicy so the test IAM role can be created correctly. --- aws/policy/paas.yaml | 9 +++++++++ aws/policy/security-services.yaml | 1 + aws/terminator/paas.py | 26 ++++++++++++++++++++++++++ 3 files changed, 36 insertions(+) diff --git a/aws/policy/paas.yaml b/aws/policy/paas.yaml index 8b799b3..c4b750e 100644 --- a/aws/policy/paas.yaml +++ b/aws/policy/paas.yaml @@ -114,6 +114,10 @@ Statement: - sagemaker:DeleteCodeRepository - sagemaker:DescribeCodeRepository - sagemaker:UpdateCodeRepository + - sagemaker:CreateImage + - sagemaker:DeleteImage + - sagemaker:DescribeImage + - sagemaker:UpdateImage Resource: - 'arn:aws:bedrock:{{ aws_region }}:{{ aws_account_id }}:agent/*' - 'arn:aws:bedrock:{{ aws_region }}:{{ aws_account_id }}:agent-alias/*' @@ -131,6 +135,7 @@ Statement: - 'arn:aws:lightsail:{{ aws_region }}:{{ aws_account_id }}:*' - 'arn:aws:lambda:{{ aws_region }}:{{ aws_account_id }}:layer:*' - 'arn:aws:sagemaker:{{ aws_region }}:{{ aws_account_id }}:code-repository/*' + - 'arn:aws:sagemaker:{{ aws_region }}:{{ aws_account_id }}:image/*' - Sid: AllowUnrestrictedResourceActionsWhichIncurFees Effect: Allow @@ -157,6 +162,10 @@ Statement: - lambda:GetEventSourceMapping - lambda:List* - sagemaker:ListCodeRepositories + - sagemaker:ListImages + - sagemaker:AddTags + - sagemaker:DeleteTags + - sagemaker:ListTags Resource: - "*" diff --git a/aws/policy/security-services.yaml b/aws/policy/security-services.yaml index 3aeb98a..195f397 100644 --- a/aws/policy/security-services.yaml +++ b/aws/policy/security-services.yaml @@ -14,6 +14,7 @@ Statement: ArnLike: iam:PolicyArn: - 'arn:aws:iam::aws:policy/AmazonBedrockFullAccess' + - 'arn:aws:iam::aws:policy/AmazonSageMakerFullAccess' - 'arn:aws:iam::aws:policy/AWSDenyAll' - 'arn:aws:iam::aws:policy/AmazonEKSServicePolicy' - 'arn:aws:iam::aws:policy/AmazonEKSClusterPolicy' diff --git a/aws/terminator/paas.py b/aws/terminator/paas.py index 6d522cc..9e8078f 100644 --- a/aws/terminator/paas.py +++ b/aws/terminator/paas.py @@ -435,3 +435,29 @@ def name(self): def terminate(self): self.client.delete_code_repository(CodeRepositoryName=self.name) + + +class SageMakerImage(Terminator): + @staticmethod + def create(credentials): + def _paginate_list_images(client): + images = client.get_paginator('list_images').paginate().build_full_result()['Images'] + + return [] if not images else images + + return Terminator._create(credentials, SageMakerImage, 'sagemaker', _paginate_list_images) + + @property + def created_time(self): + return self.instance.get('CreationTime') + + @property + def id(self): + return self.instance['ImageArn'] + + @property + def name(self): + return self.instance['ImageName'] + + def terminate(self): + self.client.delete_image(ImageName=self.name) From bfd8a1ad8551790e6c3ae1bca7a55e39fd8c91ba Mon Sep 17 00:00:00 2001 From: Jan Likar Date: Wed, 19 Aug 2026 10:25:40 +0200 Subject: [PATCH 2/2] Split policies to honor file size limits --- aws/policy/paas-sagemaker.yaml | 28 +++++++++++++++++++++++ aws/policy/paas.yaml | 15 ------------- aws/policy/security-services-slr.yaml | 32 +++++++++++++++++++++++++++ aws/policy/security-services.yaml | 30 ------------------------- 4 files changed, 60 insertions(+), 45 deletions(-) create mode 100644 aws/policy/paas-sagemaker.yaml create mode 100644 aws/policy/security-services-slr.yaml diff --git a/aws/policy/paas-sagemaker.yaml b/aws/policy/paas-sagemaker.yaml new file mode 100644 index 0000000..c09456d --- /dev/null +++ b/aws/policy/paas-sagemaker.yaml @@ -0,0 +1,28 @@ +Version: '2012-10-17' +Statement: + + - Sid: SagemakerRestrictedActionsWhichIncurNoFees + Effect: Allow + Action: + - sagemaker:CreateCodeRepository + - sagemaker:DeleteCodeRepository + - sagemaker:DescribeCodeRepository + - sagemaker:UpdateCodeRepository + - sagemaker:CreateImage + - sagemaker:DeleteImage + - sagemaker:DescribeImage + - sagemaker:UpdateImage + Resource: + - 'arn:aws:sagemaker:{{ aws_region }}:{{ aws_account_id }}:code-repository/*' + - 'arn:aws:sagemaker:{{ aws_region }}:{{ aws_account_id }}:image/*' + + - Sid: SagemakerUnrestrictedActionsWhichIncurNoFees + Effect: Allow + Action: + - sagemaker:ListCodeRepositories + - sagemaker:ListImages + - sagemaker:AddTags + - sagemaker:DeleteTags + - sagemaker:ListTags + Resource: + - "*" diff --git a/aws/policy/paas.yaml b/aws/policy/paas.yaml index c4b750e..1d376e7 100644 --- a/aws/policy/paas.yaml +++ b/aws/policy/paas.yaml @@ -110,14 +110,6 @@ Statement: - lightsail:GetInstanceSnapshot - lightsail:DeleteInstanceSnapshot - lightsail:GetInstanceSnapshots - - sagemaker:CreateCodeRepository - - sagemaker:DeleteCodeRepository - - sagemaker:DescribeCodeRepository - - sagemaker:UpdateCodeRepository - - sagemaker:CreateImage - - sagemaker:DeleteImage - - sagemaker:DescribeImage - - sagemaker:UpdateImage Resource: - 'arn:aws:bedrock:{{ aws_region }}:{{ aws_account_id }}:agent/*' - 'arn:aws:bedrock:{{ aws_region }}:{{ aws_account_id }}:agent-alias/*' @@ -134,8 +126,6 @@ Statement: - 'arn:aws:lambda:{{ aws_region }}:{{ aws_account_id }}:function:*' - 'arn:aws:lightsail:{{ aws_region }}:{{ aws_account_id }}:*' - 'arn:aws:lambda:{{ aws_region }}:{{ aws_account_id }}:layer:*' - - 'arn:aws:sagemaker:{{ aws_region }}:{{ aws_account_id }}:code-repository/*' - - 'arn:aws:sagemaker:{{ aws_region }}:{{ aws_account_id }}:image/*' - Sid: AllowUnrestrictedResourceActionsWhichIncurFees Effect: Allow @@ -161,11 +151,6 @@ Statement: - ecr:PutImageTagMutability - lambda:GetEventSourceMapping - lambda:List* - - sagemaker:ListCodeRepositories - - sagemaker:ListImages - - sagemaker:AddTags - - sagemaker:DeleteTags - - sagemaker:ListTags Resource: - "*" diff --git a/aws/policy/security-services-slr.yaml b/aws/policy/security-services-slr.yaml new file mode 100644 index 0000000..0590893 --- /dev/null +++ b/aws/policy/security-services-slr.yaml @@ -0,0 +1,32 @@ +Version: '2012-10-17' +Statement: + + # This allows AWS Services to automatically create their Default Service Linked Roles + # These have fixed policies and can only be assumed by the service itself. + - Sid: ServiceLinkedRoleCreation + Effect: Allow + Action: + - iam:CreateServiceLinkedRole + Resource: + - 'arn:aws:iam::{{ aws_account_id }}:role/aws-service-role/autoscaling.amazonaws.com/*' + - 'arn:aws:iam::{{ aws_account_id }}:role/aws-service-role/bedrock.amazonaws.com/*' + - 'arn:aws:iam::{{ aws_account_id }}:role/aws-service-role/spot.amazonaws.com/*' + - 'arn:aws:iam::{{ aws_account_id }}:role/aws-service-role/eks-fargate.amazonaws.com/*' + - 'arn:aws:iam::{{ aws_account_id }}:role/aws-service-role/eks-nodegroup.amazonaws.com/*' + - 'arn:aws:iam::{{ aws_account_id }}:role/aws-service-role/transitgateway.amazonaws.com/*' + - 'arn:aws:iam::{{ aws_account_id }}:role/aws-service-role/network-firewall.amazonaws.com/*' + - 'arn:aws:iam::{{ aws_account_id }}:role/aws-service-role/ecs.amazonaws.com/*' + - 'arn:aws:iam::{{ aws_account_id }}:role/aws-service-role/memorydb.amazonaws.com/*' + Condition: + ForAnyValue:StringEquals: + iam:AWSServiceName: + - 'autoscaling.amazonaws.com' + - 'bedrock.amazonaws.com' + - 'spot.amazonaws.com' + - 'eks-fargate.amazonaws.com' + - 'eks-nodegroup.amazonaws.com' + - 'transitgateway.amazonaws.com' + - 'network-firewall.amazonaws.com' + - 'ecs.amazonaws.com' + - 'ecs-test.amazonaws.com' + - 'memorydb.amazonaws.com' diff --git a/aws/policy/security-services.yaml b/aws/policy/security-services.yaml index 195f397..63d886f 100644 --- a/aws/policy/security-services.yaml +++ b/aws/policy/security-services.yaml @@ -159,33 +159,3 @@ Statement: - 'arn:aws:logs:{{ aws_region }}:{{ aws_account_id }}:log-group:*' - 'arn:aws:logs:{{ aws_region }}:{{ aws_account_id }}:log-group:ansible-test*' - 'arn:aws:iam::{{ aws_account_id }}:role/aws-service-role/ecs.amazonaws.com/AWSServiceRoleForECS' - - # This allows AWS Services to automatically create their Default Service Linked Roles - # These have fixed policies and can only be assumed by the service itself. - - Sid: ServiceLinkedRoleCreation - Effect: Allow - Action: - - iam:CreateServiceLinkedRole - Resource: - - 'arn:aws:iam::{{ aws_account_id }}:role/aws-service-role/autoscaling.amazonaws.com/*' - - 'arn:aws:iam::{{ aws_account_id }}:role/aws-service-role/bedrock.amazonaws.com/*' - - 'arn:aws:iam::{{ aws_account_id }}:role/aws-service-role/spot.amazonaws.com/*' - - 'arn:aws:iam::{{ aws_account_id }}:role/aws-service-role/eks-fargate.amazonaws.com/*' - - 'arn:aws:iam::{{ aws_account_id }}:role/aws-service-role/eks-nodegroup.amazonaws.com/*' - - 'arn:aws:iam::{{ aws_account_id }}:role/aws-service-role/transitgateway.amazonaws.com/*' - - 'arn:aws:iam::{{ aws_account_id }}:role/aws-service-role/network-firewall.amazonaws.com/*' - - 'arn:aws:iam::{{ aws_account_id }}:role/aws-service-role/ecs.amazonaws.com/*' - - 'arn:aws:iam::{{ aws_account_id }}:role/aws-service-role/memorydb.amazonaws.com/*' - Condition: - ForAnyValue:StringEquals: - iam:AWSServiceName: - - 'autoscaling.amazonaws.com' - - 'bedrock.amazonaws.com' - - 'spot.amazonaws.com' - - 'eks-fargate.amazonaws.com' - - 'eks-nodegroup.amazonaws.com' - - 'transitgateway.amazonaws.com' - - 'network-firewall.amazonaws.com' - - 'ecs.amazonaws.com' - - 'ecs-test.amazonaws.com' - - 'memorydb.amazonaws.com'