[stepfunctions-tasks] SageMakerUpdateEndpoint creates wrong permissions

[cmwilhelm]

❓ General Issue

The Question

There appear to be some incorrect permissions generated when using the aws_stepfunctions_tasks.SageMakerUpdateEndpoint construct in a state machine
created through CDK.

Specifically, the state machine role is granted a permission for updateEndpoint against
resource "arn:aws:sagemaker:<REGION>:<ACCOUNT_ID>:endpoint/*". However, from
the error messages in my StepFn invocation, it appears the resource target should actually
be endpoint-config/*:

{
  "resourceType": "sagemaker",
  "resource": "updateEndpoint",
  "error": "SageMaker.AmazonSageMakerException",
  "cause": "User: arn:aws:sts::<ACCOUNT_DI>:assumed-role/<STATE_MACHINE_NAME>-StateMachineRole<ROLE_ID> is not authorized to perform: sagemaker:UpdateEndpoint on resource: arn:aws:sagemaker:<REGION>:<ACCOUNT_ID>:endpoint-config/<ENDPOINT_CONFIG_NAME> (Service: AmazonSageMaker; Status Code: 400; Error Code: AccessDeniedException; Request ID: 3c22b7ab-4687-475a-b82c-643a75f21a13; Proxy: null)"
}

Environment

We're currently pinned at CDK core and CDK module versions 1.72, using the python bindings.
However, I checked the release notes and did not see any mention of fixes since then to this stepfn task.

[NGL321]

From what I can tell from the SageMaker docs, they indicate the proper policies for CreateEndpoint, but do not indicate for UpdateEndpoint. So I think it is fair to say that the policies for UpdateEndpoint should match those for CreateEndpoint.

At the moment, you are correct and update-endpoint only adds policy for endpoint/* not endpoint-config/* as docs would indicate:

aws-cdk/packages/@aws-cdk/aws-stepfunctions-tasks/lib/sagemaker/update-endpoint.ts

Lines 62 to 79 in 054610f

	private makePolicyStatements(): iam.PolicyStatement[] {
	const stack = cdk.Stack.of(this);
	// https://docs.aws.amazon.com/sagemaker/latest/dg/api-permissions-reference.html
	return [
	new iam.PolicyStatement({
	actions: ['sagemaker:updateEndpoint'],
	resources: [
	stack.formatArn({
	service: 'sagemaker',
	resource: 'endpoint',
	// If the endpoint name comes from input, we cannot target the policy to a particular ARN prefix reliably.
	// SageMaker uses lowercase for resource name in the arn
	resourceName: sfn.JsonPath.isEncodedJsonPath(this.props.endpointName) ? '*' : `${this.props.endpointName.toLowerCase()}`,
	}),
	],
	}),
	];
	}

I can confirm this bug, and it should only be a 1 line fix!

😸 😷

[zxkane]

Any plan for fixing it or requiring someone contributing PR?

[shivlaks]

@zxkane happy to review it if you want to submit one! it's not currently on my radar but I can pick it up if nobody's interested 😅

[github-actions]

⚠️COMMENT VISIBILITY WARNING⚠️

Comments on closed issues are hard for our team to see.
If you need more assistance, please either tag a team member or open a new issue that references this one.
If you wish to keep having a conversation with other community members under this issue feel free to do so.