fix(stepfunctions): SageMakeUpdateEndpoint adds insufficient permissions

packages/@aws-cdk/aws-stepfunctions-tasks/lib/sagemaker/update-endpoint.ts

@@ -73,6 +73,13 @@ export class SageMakerUpdateEndpoint extends sfn.TaskStateBase {
  // SageMaker uses lowercase for resource name in the arn
  resourceName: sfn.JsonPath.isEncodedJsonPath(this.props.endpointName) ? '*' : `${this.props.endpointName.toLowerCase()}`,
  }),
+ stack.formatArn({
+ service: 'sagemaker',
+ resource: 'endpoint-config',
+ // If the endpointConfig name comes from input, we cannot target the policy to a particular ARN prefix reliably.
+ // SageMaker uses lowercase for resource name in the arn
+ resourceName: sfn.JsonPath.isEncodedJsonPath(this.props.endpointConfigName) ? '*' : `${this.props.endpointConfigName.toLowerCase()}`,
+ }),
  ],
  }),
  ];

packages/@aws-cdk/aws-stepfunctions-tasks/test/sagemaker/integ.call-sagemaker.expected.json

@@ -465,26 +465,48 @@
  {
  "Action": "sagemaker:updateEndpoint",
  "Effect": "Allow",
- "Resource": {
- "Fn::Join": [
- "",
- [
- "arn:",
- {
- "Ref": "AWS::Partition"
- },
- ":sagemaker:",
- {
- "Ref": "AWS::Region"
- },
- ":",
- {
- "Ref": "AWS::AccountId"
- },
- ":endpoint/*"
+ "Resource": [
+ {
+ "Fn::Join": [
+ "",
+ [
+ "arn:",
+ {
+ "Ref": "AWS::Partition"
+ },
+ ":sagemaker:",
+ {
+ "Ref": "AWS::Region"
+ },
+ ":",
+ {
+ "Ref": "AWS::AccountId"
+ },
+ ":endpoint/*"
+ ]
  ]
- ]
- }
+ },
+ {
+ "Fn::Join": [
+ "",
+ [
+ "arn:",
+ {
+ "Ref": "AWS::Partition"
+ },
+ ":sagemaker:",
+ {
+ "Ref": "AWS::Region"
+ },
+ ":",
+ {
+ "Ref": "AWS::AccountId"
+ },
+ ":endpoint-config/*"
+ ]
+ ]
+ }
+ ]
  }
  ],
  "Version": "2012-10-17"

packages/@aws-cdk/aws-stepfunctions-tasks/test/sagemaker/update-endpoint.test.ts

@@ -1,4 +1,5 @@
 import '@aws-cdk/assert/jest';
+import * as iam from '@aws-cdk/aws-iam';
 import * as sfn from '@aws-cdk/aws-stepfunctions';
 import * as cdk from '@aws-cdk/core';
 import * as tasks from '../../lib';
@@ -80,3 +81,65 @@ test('Task throws if WAIT_FOR_TASK_TOKEN is supplied as service integration patt
  });
  }).toThrow(/Unsupported service integration pattern. Supported Patterns: REQUEST_RESPONSE. Received: WAIT_FOR_TASK_TOKEN/i);
 });
+
+test('PolicyStatement has sufficient permissions', () => {
+ // WHEN
+ const props = {
+ endpointName: 'MyEndpoint',
+ endpointConfigName: 'MyEndpointConfig',
+ };
+ const task = new tasks.SageMakerUpdateEndpoint(stack, 'SagemakerEndpoint', props);
+
+ const graph = new sfn.StateGraph(task, 'test');
+
+ // THEN
+ expect(graph.policyStatements).toEqual(
+ [
+ new iam.PolicyStatement({
+ actions: ['sagemaker:updateEndpoint'],
+ resources: [
+ stack.formatArn({
+ service: 'sagemaker',
+ resource: 'endpoint',
+ resourceName: props.endpointName.toLowerCase(),
+ }),
+ stack.formatArn({
+ service: 'sagemaker',
+ resource: 'endpoint-config',
+ resourceName: props.endpointConfigName.toLowerCase(),
+ }),
+ ],
+ }),
+ ],
+ );
+
+ // WHEN
+ const props2 = {
+ endpointName: sfn.JsonPath.stringAt('$.Endpoint.Name'),
+ endpointConfigName: sfn.JsonPath.stringAt('$.Endpoint.Config'),
+ };
+ const task2 = new tasks.SageMakerUpdateEndpoint(stack, 'SagemakerEndpoint2', props2);
+
+ const graph2 = new sfn.StateGraph(task2, 'test');
+
+ // THEN
+ expect(graph2.policyStatements).toEqual(
+ [
+ new iam.PolicyStatement({
+ actions: ['sagemaker:updateEndpoint'],
+ resources: [
+ stack.formatArn({
+ service: 'sagemaker',
+ resource: 'endpoint',
+ resourceName: '*',
+ }),
+ stack.formatArn({
+ service: 'sagemaker',
+ resource: 'endpoint-config',
+ resourceName: '*',
+ }),
+ ],
+ }),
+ ],
+ );
+});