setup/create_studio_domain.yaml [189:282]:
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
      AppType: KernelGateway
      DomainId: !GetAtt StudioDomain.DomainId
      ResourceSpec: 
        InstanceType: ml.m5.4xlarge
        SageMakerImageArn: !FindInMap
          - RegionMap
          - !Ref 'AWS::Region'
          - datawrangler
      UserProfileName: !Ref UserProfileName

  SageMakerExecutionRole:
    Type: "AWS::IAM::Role"
    Properties:
      RoleName: "AmazonSageMaker-ExecutionRole-endtoendml"
      AssumeRolePolicyDocument:
        Version: 2012-10-17
        Statement:
          - Effect: Allow
            Principal:
              Service:
                - sagemaker.amazonaws.com
            Action:
              - "sts:AssumeRole"
      Path: "/service-role/"
      ManagedPolicyArns:
        - arn:aws:iam::aws:policy/AmazonSageMakerFullAccess
        - arn:aws:iam::aws:policy/AmazonS3FullAccess
      Policies:
        - PolicyName: GlueFullAccess-endtoendml
          PolicyDocument:
            Version: '2012-10-17'
            Statement:
              - Effect: Allow
                Action:
                  - glue:*
                Resource: "*"
        - PolicyName: AthenaFullAccess-endtoendml
          PolicyDocument:
            Version: '2012-10-17'
            Statement:
              - Effect: Allow
                Action:
                  - athena:*
                Resource: "*"
        - PolicyName: PassRole-endtoendml
          PolicyDocument:
            Version: '2012-10-17'
            Statement:
              - Effect: Allow
                Action:
                  - iam:GetRole
                  - iam:PassRole
                Resource: "*"

  GlueServiceRole:
    Type: "AWS::IAM::Role"
    Properties:
      RoleName: "GlueServiceRole-endtoendml"
      AssumeRolePolicyDocument:
        Statement:
          - Effect: "Allow"
            Principal:
              Service:
                - "glue.amazonaws.com"
            Action:
              - "sts:AssumeRole"
      ManagedPolicyArns:
        - "arn:aws:iam::aws:policy/service-role/AWSGlueServiceRole"
        - "arn:aws:iam::aws:policy/AmazonS3FullAccess"
      Path: "/service-role/"

  LambdaInvokeSageMakerEndpointRole:
    Type: AWS::IAM::Role
    Properties:
      RoleName: "LambdaInvokeSageMakerEndpointRole-endtoendml"
      AssumeRolePolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Effect: Allow
            Principal:
              Service:
                - lambda.amazonaws.com
            Action:
              - sts:AssumeRole
      Path: /
      Policies:
        - PolicyName: LambdaInvokeSageMakerEndpointPolicy-endtoendml
          PolicyDocument:
            Version: '2012-10-17'
            Statement:
              - Effect: Allow
                Action:
                  - sagemaker:InvokeEndpoint
                Resource: "*"
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -



setup/create_studio_domain_vpc.yaml [283:376]:
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
      AppType: KernelGateway
      DomainId: !GetAtt StudioDomain.DomainId
      ResourceSpec: 
        InstanceType: ml.m5.4xlarge
        SageMakerImageArn: !FindInMap
          - RegionMap
          - !Ref 'AWS::Region'
          - datawrangler
      UserProfileName: !Ref UserProfileName

  SageMakerExecutionRole:
    Type: "AWS::IAM::Role"
    Properties:
      RoleName: "AmazonSageMaker-ExecutionRole-endtoendml"
      AssumeRolePolicyDocument:
        Version: 2012-10-17
        Statement:
          - Effect: Allow
            Principal:
              Service:
                - sagemaker.amazonaws.com
            Action:
              - "sts:AssumeRole"
      Path: "/service-role/"
      ManagedPolicyArns:
        - arn:aws:iam::aws:policy/AmazonSageMakerFullAccess
        - arn:aws:iam::aws:policy/AmazonS3FullAccess
      Policies:
        - PolicyName: GlueFullAccess-endtoendml
          PolicyDocument:
            Version: '2012-10-17'
            Statement:
              - Effect: Allow
                Action:
                  - glue:*
                Resource: "*"
        - PolicyName: AthenaFullAccess-endtoendml
          PolicyDocument:
            Version: '2012-10-17'
            Statement:
              - Effect: Allow
                Action:
                  - athena:*
                Resource: "*"
        - PolicyName: PassRole-endtoendml
          PolicyDocument:
            Version: '2012-10-17'
            Statement:
              - Effect: Allow
                Action:
                  - iam:GetRole
                  - iam:PassRole
                Resource: "*"

  GlueServiceRole:
    Type: "AWS::IAM::Role"
    Properties:
      RoleName: "GlueServiceRole-endtoendml"
      AssumeRolePolicyDocument:
        Statement:
          - Effect: "Allow"
            Principal:
              Service:
                - "glue.amazonaws.com"
            Action:
              - "sts:AssumeRole"
      ManagedPolicyArns:
        - "arn:aws:iam::aws:policy/service-role/AWSGlueServiceRole"
        - "arn:aws:iam::aws:policy/AmazonS3FullAccess"
      Path: "/service-role/"

  LambdaInvokeSageMakerEndpointRole:
    Type: AWS::IAM::Role
    Properties:
      RoleName: "LambdaInvokeSageMakerEndpointRole-endtoendml"
      AssumeRolePolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Effect: Allow
            Principal:
              Service:
                - lambda.amazonaws.com
            Action:
              - sts:AssumeRole
      Path: /
      Policies:
        - PolicyName: LambdaInvokeSageMakerEndpointPolicy-endtoendml
          PolicyDocument:
            Version: '2012-10-17'
            Statement:
              - Effect: Allow
                Action:
                  - sagemaker:InvokeEndpoint
                Resource: "*"
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -



