Add SageMaker Image IAM permissions and terminator

aws/policy/paas-sagemaker.yaml

@@ -0,0 +1,28 @@
+Version: '2012-10-17'
+Statement:
+
+  - Sid: SagemakerRestrictedActionsWhichIncurNoFees
+    Effect: Allow
+    Action:
+      - sagemaker:CreateCodeRepository
+      - sagemaker:DeleteCodeRepository
+      - sagemaker:DescribeCodeRepository
+      - sagemaker:UpdateCodeRepository
+      - sagemaker:CreateImage
+      - sagemaker:DeleteImage
+      - sagemaker:DescribeImage
+      - sagemaker:UpdateImage
+    Resource:
+      - 'arn:aws:sagemaker:{{ aws_region }}:{{ aws_account_id }}:code-repository/*'
+      - 'arn:aws:sagemaker:{{ aws_region }}:{{ aws_account_id }}:image/*'
+
+  - Sid: SagemakerUnrestrictedActionsWhichIncurNoFees
+    Effect: Allow
+    Action:
+      - sagemaker:ListCodeRepositories
+      - sagemaker:ListImages
+      - sagemaker:AddTags
+      - sagemaker:DeleteTags
+      - sagemaker:ListTags
+    Resource:
+      - "*"

aws/policy/paas.yaml

@@ -110,10 +110,6 @@ Statement:
       - lightsail:GetInstanceSnapshot
       - lightsail:DeleteInstanceSnapshot
       - lightsail:GetInstanceSnapshots
-      - sagemaker:CreateCodeRepository
-      - sagemaker:DeleteCodeRepository
-      - sagemaker:DescribeCodeRepository
-      - sagemaker:UpdateCodeRepository
     Resource:
       - 'arn:aws:bedrock:{{ aws_region }}:{{ aws_account_id }}:agent/*'
       - 'arn:aws:bedrock:{{ aws_region }}:{{ aws_account_id }}:agent-alias/*'
@@ -130,7 +126,6 @@ Statement:
       - 'arn:aws:lambda:{{ aws_region }}:{{ aws_account_id }}:function:*'
       - 'arn:aws:lightsail:{{ aws_region }}:{{ aws_account_id }}:*'
       - 'arn:aws:lambda:{{ aws_region }}:{{ aws_account_id }}:layer:*'
-      - 'arn:aws:sagemaker:{{ aws_region }}:{{ aws_account_id }}:code-repository/*'
 
   - Sid: AllowUnrestrictedResourceActionsWhichIncurFees
     Effect: Allow
@@ -156,7 +151,6 @@ Statement:
       - ecr:PutImageTagMutability
       - lambda:GetEventSourceMapping
       - lambda:List*
-      - sagemaker:ListCodeRepositories
     Resource:
       - "*"
 

aws/policy/security-services-slr.yaml

@@ -0,0 +1,32 @@
+Version: '2012-10-17'
+Statement:
+
+  # This allows AWS Services to automatically create their Default Service Linked Roles
+  # These have fixed policies and can only be assumed by the service itself.
+  - Sid: ServiceLinkedRoleCreation
+    Effect: Allow
+    Action:
+      - iam:CreateServiceLinkedRole
+    Resource:
+      - 'arn:aws:iam::{{ aws_account_id }}:role/aws-service-role/autoscaling.amazonaws.com/*'
+      - 'arn:aws:iam::{{ aws_account_id }}:role/aws-service-role/bedrock.amazonaws.com/*'
+      - 'arn:aws:iam::{{ aws_account_id }}:role/aws-service-role/spot.amazonaws.com/*'
+      - 'arn:aws:iam::{{ aws_account_id }}:role/aws-service-role/eks-fargate.amazonaws.com/*'
+      - 'arn:aws:iam::{{ aws_account_id }}:role/aws-service-role/eks-nodegroup.amazonaws.com/*'
+      - 'arn:aws:iam::{{ aws_account_id }}:role/aws-service-role/transitgateway.amazonaws.com/*'
+      - 'arn:aws:iam::{{ aws_account_id }}:role/aws-service-role/network-firewall.amazonaws.com/*'
+      - 'arn:aws:iam::{{ aws_account_id }}:role/aws-service-role/ecs.amazonaws.com/*'
+      - 'arn:aws:iam::{{ aws_account_id }}:role/aws-service-role/memorydb.amazonaws.com/*'
+    Condition:
+      ForAnyValue:StringEquals:
+        iam:AWSServiceName:
+          - 'autoscaling.amazonaws.com'
+          - 'bedrock.amazonaws.com'
+          - 'spot.amazonaws.com'
+          - 'eks-fargate.amazonaws.com'
+          - 'eks-nodegroup.amazonaws.com'
+          - 'transitgateway.amazonaws.com'
+          - 'network-firewall.amazonaws.com'
+          - 'ecs.amazonaws.com'
+          - 'ecs-test.amazonaws.com'
+          - 'memorydb.amazonaws.com'

aws/policy/security-services.yaml

@@ -14,6 +14,7 @@ Statement:
       ArnLike:
         iam:PolicyArn:
           - 'arn:aws:iam::aws:policy/AmazonBedrockFullAccess'
+          - 'arn:aws:iam::aws:policy/AmazonSageMakerFullAccess'
           - 'arn:aws:iam::aws:policy/AWSDenyAll'
           - 'arn:aws:iam::aws:policy/AmazonEKSServicePolicy'
           - 'arn:aws:iam::aws:policy/AmazonEKSClusterPolicy'
@@ -158,33 +159,3 @@ Statement:
       - 'arn:aws:logs:{{ aws_region }}:{{ aws_account_id }}:log-group:*'
       - 'arn:aws:logs:{{ aws_region }}:{{ aws_account_id }}:log-group:ansible-test*'
       - 'arn:aws:iam::{{ aws_account_id }}:role/aws-service-role/ecs.amazonaws.com/AWSServiceRoleForECS'
-
-  # This allows AWS Services to automatically create their Default Service Linked Roles
-  # These have fixed policies and can only be assumed by the service itself.
-  - Sid: ServiceLinkedRoleCreation
-    Effect: Allow
-    Action:
-      - iam:CreateServiceLinkedRole
-    Resource:
-      - 'arn:aws:iam::{{ aws_account_id }}:role/aws-service-role/autoscaling.amazonaws.com/*'
-      - 'arn:aws:iam::{{ aws_account_id }}:role/aws-service-role/bedrock.amazonaws.com/*'
-      - 'arn:aws:iam::{{ aws_account_id }}:role/aws-service-role/spot.amazonaws.com/*'
-      - 'arn:aws:iam::{{ aws_account_id }}:role/aws-service-role/eks-fargate.amazonaws.com/*'
-      - 'arn:aws:iam::{{ aws_account_id }}:role/aws-service-role/eks-nodegroup.amazonaws.com/*'
-      - 'arn:aws:iam::{{ aws_account_id }}:role/aws-service-role/transitgateway.amazonaws.com/*'
-      - 'arn:aws:iam::{{ aws_account_id }}:role/aws-service-role/network-firewall.amazonaws.com/*'
-      - 'arn:aws:iam::{{ aws_account_id }}:role/aws-service-role/ecs.amazonaws.com/*'
-      - 'arn:aws:iam::{{ aws_account_id }}:role/aws-service-role/memorydb.amazonaws.com/*'
-    Condition:
-      ForAnyValue:StringEquals:
-        iam:AWSServiceName:
-          - 'autoscaling.amazonaws.com'
-          - 'bedrock.amazonaws.com'
-          - 'spot.amazonaws.com'
-          - 'eks-fargate.amazonaws.com'
-          - 'eks-nodegroup.amazonaws.com'
-          - 'transitgateway.amazonaws.com'
-          - 'network-firewall.amazonaws.com'
-          - 'ecs.amazonaws.com'
-          - 'ecs-test.amazonaws.com'
-          - 'memorydb.amazonaws.com'

aws/terminator/paas.py

@@ -435,3 +435,29 @@ def name(self):
 
     def terminate(self):
         self.client.delete_code_repository(CodeRepositoryName=self.name)
+
+
+class SageMakerImage(Terminator):
+    @staticmethod
+    def create(credentials):
+        def _paginate_list_images(client):
+            images = client.get_paginator('list_images').paginate().build_full_result()['Images']
+
+            return [] if not images else images
+
+        return Terminator._create(credentials, SageMakerImage, 'sagemaker', _paginate_list_images)
+
+    @property
+    def created_time(self):
+        return self.instance.get('CreationTime')
+
+    @property
+    def id(self):
+        return self.instance['ImageArn']
+
+    @property
+    def name(self):
+        return self.instance['ImageName']
+
+    def terminate(self):
+        self.client.delete_image(ImageName=self.name)