fix: add sagemaker:AddTags to sfn execute role (#1206)

awslabs · Apr 18, 2023 · cb2ce46 · cb2ce46
1 parent c4944ad
commit cb2ce46
Showing 1 changed file with 21 additions and 0 deletions.
diff --git a/src/lib/training-stack.ts b/src/lib/training-stack.ts
@@ -735,6 +735,27 @@ export class TrainingStack extends NestedStack {
       tracingEnabled: true,
     });
 
+    pipeline.role.addToPrincipalPolicy(new PolicyStatement({
+      actions: ['sagemaker:AddTags'],
+      resources: [
+        Arn.format({
+          service: 'sagemaker',
+          resource: 'training-job',
+          resourceName: 'fraud-detection-model-*',
+        }, Stack.of(this)),
+        Arn.format({
+          service: 'sagemaker',
+          resource: 'model',
+          resourceName: 'fraud-detection-model-*',
+        }, Stack.of(this)),
+        Arn.format({
+          service: 'sagemaker',
+          resource: 'endpoint',
+          resourceName: this.endpointName,
+        }, Stack.of(this)),
+      ],
+    }));
+
     (pipeline.role.node.findChild('DefaultPolicy').node.defaultChild as CfnResource)
       .addMetadata('cfn_nag', {
         rules_to_suppress: [