hf-cloud-sagemaker-iam-preflight

1# SageMaker IAM Preflight
2 
3Every SageMaker resource needs an **execution role** — the IAM role SageMaker assumes to read model artifacts from S3, pull serving containers from ECR, and write logs. Most deployments fail here because the script tried to create a new role without checking if a usable one already existed, then blew up because the caller is an SSO principal.
4 
5This skill encodes the right order: discover, validate, only create if necessary.
6 
7## Running the helpers (cross-platform)
8 
9The helpers are Python so they run identically on Windows, macOS, and Linux:
10 
11```bash
12python3 scripts/check_role.py        # macOS / Linux
13python  scripts/check_role.py        # Windows (PowerShell / cmd)
14```
15 
16**Run them from the shell where the AWS CLI already works** — i.e. wherever `aws sts get-caller-identity` succeeds. The script shells out to that same `aws` binary and inherits the shell's profile, region, SSO session, proxy, and credential chain.
17…