Hf Cloud Sagemaker Iam Preflight
Verify or select a SageMaker execution role before creating models, endpoints, or...
Install
npx skills add waybarrios/opencode-power-pack --skill hf-cloud-sagemaker-iam-preflight -g -a claude-code -y- Repository
- waybarrios/opencode-power-pack549
- Category
- Engineering
- Updated
- 8d ago
- License
- MIT
- Context cost
- Mediumabout 1,524 tokens
- Runs scripts
- Yes, review before use
What it does
Verify or select a SageMaker execution role before creating models, endpoints, or training jobs. Use when a role ARN is missing or IAM access fails; inspect existing roles before proposing role creation.
SageMaker IAM Preflight
Every SageMaker resource needs an execution role, the IAM role SageMaker assumes to read model artifacts from S3, pull serving containers from ECR, and write logs. Most deployments fail here because the script tried to create a new role without checking if a usable one already existed, then blew up because the caller is an SSO principal.
This skill encodes the right order: discover, validate, only create if necessary.
Running the helpers (cross-platform)
The helpers are Python so they run identically on Windows, macOS, and Linux:
python3 scripts/check_role.py # macOS / Linux
python scripts/check_role.py # Windows (PowerShell / cmd)
Run them from the shell where the AWS CLI already works, i.e. wherever aws sts get-caller-identity succeeds. The script shells out to that same aws binary and inherits the shell's profile, region, SSO session, proxy, and credential chain.
Windows / WSL / Git Bash caveat. Do not invoke these through a Bash shim (WSL, Git Bash, MSYS) on Windows. Those Bash environments frequently do not share the Windows AWS config, credentials, SSO sessions, environment variables, or proxy settings, so
aws sts get-caller-identityfails inside Bash even when it works natively in PowerShell. (This is exactly why the old.shhelpers failed on Windows and were replaced with Python.) If you're in PowerShell, runpython ...\check_role.pydirectly in PowerShell. If the helper still can't see your identity, run the same discovery natively (see "Native AWS CLI equivalent" below) in the shell whereaws sts get-caller-identityreturns your ARN.
Order of operations
Step 1, Did the user provide a role?
Validate that one specifically:
python3 scripts/check_role.py "<role-name-or-arn>"
On success it prints the ARN to stdout (exit 0). On failure it logs why on stderr. Don't try to silently fix a broken role, surface the problem.
