domains / families / devops / hf-cloud-sagemaker-iam-preflight

hf-cloud-sagemaker-iam-preflight

separate

Ensure a usable SageMaker execution role exists before deploying or training. Use this skill whenever about to create a SageMaker endpoint, model, training job, or any resource that requires an execution role. Use it especially when the user has not provided a role ARN explicitly, when scripts are about to call `iam:CreateRole`, or when an AccessDenied error mentions an IAM action. Never blindly call `iam:CreateRole` — always check for existing roles first. This skill prevents the most common SageMaker deployment failure: trying to create IAM resources from an SSO principal that has no IAM write permissions.

When to use

• Creating SageMaker endpoints
• Creating SageMaker models
• Creating SageMaker training jobs
• Validating user-provided role ARNs
• Discovering existing SageMaker execution roles
• Creating new execution roles if none exist
• Handling AccessDenied errors for IAM actions

When not to use

• Blindly calling iam:CreateRole without checking existing roles
• Silently fixing broken roles
• Attaching AmazonSageMakerFullAccess policy
• Deferring permission review until AccessDenied failure

Skill page

Source