in src/sagemaker_core/helper/session_helper.py [0:0]
def get_caller_identity_arn(self):
"""Returns the ARN user or role whose credentials are used to call the API.
Returns:
str: The ARN user or role
"""
if os.path.exists(NOTEBOOK_METADATA_FILE):
with open(NOTEBOOK_METADATA_FILE, "rb") as f:
metadata = json.loads(f.read())
instance_name = metadata.get("ResourceName")
domain_id = metadata.get("DomainId")
user_profile_name = metadata.get("UserProfileName")
execution_role_arn = metadata.get("ExecutionRoleArn")
try:
if domain_id is None:
instance_desc = self.sagemaker_client.describe_notebook_instance(
NotebookInstanceName=instance_name
)
return instance_desc["RoleArn"]
# find execution role from the metadata file if present
if execution_role_arn is not None:
return execution_role_arn
user_profile_desc = self.sagemaker_client.describe_user_profile(
DomainId=domain_id, UserProfileName=user_profile_name
)
# First, try to find role in userSettings
if user_profile_desc.get("UserSettings", {}).get("ExecutionRole"):
return user_profile_desc["UserSettings"]["ExecutionRole"]
# If not found, fallback to the domain
domain_desc = self.sagemaker_client.describe_domain(DomainId=domain_id)
return domain_desc["DefaultUserSettings"]["ExecutionRole"]
except ClientError:
logger.debug(
"Couldn't call 'describe_notebook_instance' to get the Role "
"ARN of the instance %s.",
instance_name,
)
assumed_role = self.boto_session.client(
"sts",
region_name=self.boto_region_name,
endpoint_url=sts_regional_endpoint(self.boto_region_name),
).get_caller_identity()["Arn"]
role = re.sub(r"^(.+)sts::(\d+):assumed-role/(.+?)/.*$", r"\1iam::\2:role/\3", assumed_role)
# Call IAM to get the role's path
role_name = role[role.rfind("/") + 1 :]
try:
role = self.boto_session.client("iam").get_role(RoleName=role_name)["Role"]["Arn"]
except ClientError:
logger.warning(
"Couldn't call 'get_role' to get Role ARN from role name %s to get Role path.",
role_name,
)
# This conditional has been present since the inception of SageMaker
# Guessing this conditional's purpose was to handle lack of IAM permissions
# https://github.com/aws/sagemaker-python-sdk/issues/2089#issuecomment-791802713
if "AmazonSageMaker-ExecutionRole" in assumed_role:
logger.warning(
"Assuming role was created in SageMaker AWS console, "
"as the name contains `AmazonSageMaker-ExecutionRole`. "
"Defaulting to Role ARN with service-role in path. "
"If this Role ARN is incorrect, please add "
"IAM read permissions to your role or supply the "
"Role Arn directly."
)
role = re.sub(
r"^(.+)sts::(\d+):assumed-role/(.+?)/.*$",
r"\1iam::\2:role/service-role/\3",
assumed_role,
)
return role