modules/data/templates/roles.yaml [1:104]:
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
AWSTemplateFormatVersion: '2010-09-09'
Description: A training pipeline Step Functions state machine.

Parameters:
  TargetEnv:
    Type: String

Resources:
  # Define Step Function Role
  WorkflowExecutionRole:
    Type: "AWS::IAM::Role"
    Properties:
      AssumeRolePolicyDocument:
        Version: "2012-10-17"
        Statement:
          - Effect: "Allow"
            Principal:
              Service: !Sub states.amazonaws.com
            Action: "sts:AssumeRole"
      Path: "/"
      Policies:
        - PolicyName: PassRolePolicy
          PolicyDocument:
            Version: "2012-10-17"
            Statement:
              - Effect: Allow
                Action:
                  - 'iam:PassRole'
                Resource: "*"
                Condition:
                  StringEquals:
                    'iam:PassedToService': sagemaker.amazonaws.com
        - PolicyName: StatesExecutionPolicy
          PolicyDocument:
            Version: 2012-10-17
            Statement:
              - Effect: Allow
                Action:
                  - 'sagemaker:CreateProcessingJob'
                  - 'sagemaker:CreateTransformJob'
                  - 'sagemaker:DescribeTransformJob'
                  - 'sagemaker:StopTransformJob'
                  - 'sagemaker:CreateTrainingJob'
                  - 'sagemaker:DescribeTrainingJob'
                  - 'sagemaker:StopTrainingJob'
                  - 'sagemaker:CreateHyperParameterTuningJob'
                  - 'sagemaker:DescribeHyperParameterTuningJob'
                  - 'sagemaker:StopHyperParameterTuningJob'
                  - 'sagemaker:CreateModel'
                  - 'sagemaker:CreateEndpointConfig'
                  - 'sagemaker:CreateEndpoint'
                  - 'sagemaker:DeleteEndpointConfig'
                  - 'sagemaker:DeleteEndpoint'
                  - 'sagemaker:UpdateEndpoint'
                  - 'sagemaker:ListTags'
                  - 'lambda:InvokeFunction'
                  - 'sqs:SendMessage'
                  - 'sns:Publish'
                  - 'ecs:RunTask'
                  - 'ecs:StopTask'
                  - 'ecs:DescribeTasks'
                  - 'dynamodb:GetItem'
                  - 'dynamodb:PutItem'
                  - 'dynamodb:UpdateItem'
                  - 'dynamodb:DeleteItem'
                  - 'batch:SubmitJob'
                  - 'batch:DescribeJobs'
                  - 'batch:TerminateJob'
                  - 'glue:StartJobRun'
                  - 'glue:GetJobRun'
                  - 'glue:GetJobRuns'
                  - 'glue:BatchStopJobRun'
                Resource: '*'
        - PolicyName: StatesStartExecutionPolicy
          PolicyDocument:
            Version: "2012-10-17"
            Statement:
              - Effect: Allow
                Action:
                  - "states:*"
                Resource: "*"
        - PolicyName: StatesAccessEventsPolicy
          PolicyDocument:
            Version: "2012-10-17"
            Statement:
              - Effect: Allow
                Action:
                  - "events:*"
                Resource: "*"

  # Define SageMaker Execution Role
  SagerMakerRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Version: "2012-10-17"
        Statement:
          - Effect: Allow
            Principal:
              Service: sagemaker.amazonaws.com
            Action: sts:AssumeRole
      ManagedPolicyArns:
        - "arn:aws:iam::aws:policy/AmazonSageMakerFullAccess"
        - "arn:aws:iam::aws:policy/AmazonS3FullAccess"
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -



modules/pipeline/templates/roles.yaml [1:104]:
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
AWSTemplateFormatVersion: '2010-09-09'
Description: A training pipeline Step Functions state machine.

Parameters:
  TargetEnv:
    Type: String

Resources:
  # Define Step Function Role
  WorkflowExecutionRole:
    Type: "AWS::IAM::Role"
    Properties:
      AssumeRolePolicyDocument:
        Version: "2012-10-17"
        Statement:
          - Effect: "Allow"
            Principal:
              Service: !Sub states.amazonaws.com
            Action: "sts:AssumeRole"
      Path: "/"
      Policies:
        - PolicyName: PassRolePolicy
          PolicyDocument:
            Version: "2012-10-17"
            Statement:
              - Effect: Allow
                Action:
                  - 'iam:PassRole'
                Resource: "*"
                Condition:
                  StringEquals:
                    'iam:PassedToService': sagemaker.amazonaws.com
        - PolicyName: StatesExecutionPolicy
          PolicyDocument:
            Version: 2012-10-17
            Statement:
              - Effect: Allow
                Action:
                  - 'sagemaker:CreateProcessingJob'
                  - 'sagemaker:CreateTransformJob'
                  - 'sagemaker:DescribeTransformJob'
                  - 'sagemaker:StopTransformJob'
                  - 'sagemaker:CreateTrainingJob'
                  - 'sagemaker:DescribeTrainingJob'
                  - 'sagemaker:StopTrainingJob'
                  - 'sagemaker:CreateHyperParameterTuningJob'
                  - 'sagemaker:DescribeHyperParameterTuningJob'
                  - 'sagemaker:StopHyperParameterTuningJob'
                  - 'sagemaker:CreateModel'
                  - 'sagemaker:CreateEndpointConfig'
                  - 'sagemaker:CreateEndpoint'
                  - 'sagemaker:DeleteEndpointConfig'
                  - 'sagemaker:DeleteEndpoint'
                  - 'sagemaker:UpdateEndpoint'
                  - 'sagemaker:ListTags'
                  - 'lambda:InvokeFunction'
                  - 'sqs:SendMessage'
                  - 'sns:Publish'
                  - 'ecs:RunTask'
                  - 'ecs:StopTask'
                  - 'ecs:DescribeTasks'
                  - 'dynamodb:GetItem'
                  - 'dynamodb:PutItem'
                  - 'dynamodb:UpdateItem'
                  - 'dynamodb:DeleteItem'
                  - 'batch:SubmitJob'
                  - 'batch:DescribeJobs'
                  - 'batch:TerminateJob'
                  - 'glue:StartJobRun'
                  - 'glue:GetJobRun'
                  - 'glue:GetJobRuns'
                  - 'glue:BatchStopJobRun'
                Resource: '*'
        - PolicyName: StatesStartExecutionPolicy
          PolicyDocument:
            Version: "2012-10-17"
            Statement:
              - Effect: Allow
                Action:
                  - "states:*"
                Resource: "*"
        - PolicyName: StatesAccessEventsPolicy
          PolicyDocument:
            Version: "2012-10-17"
            Statement:
              - Effect: Allow
                Action:
                  - "events:*"
                Resource: "*"

  # Define SageMaker Execution Role
  SagerMakerRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Version: "2012-10-17"
        Statement:
          - Effect: Allow
            Principal:
              Service: sagemaker.amazonaws.com
            Action: sts:AssumeRole
      ManagedPolicyArns:
        - "arn:aws:iam::aws:policy/AmazonSageMakerFullAccess"
        - "arn:aws:iam::aws:policy/AmazonS3FullAccess"
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -



