fix(stepfunctions): SageMakeUpdateEndpoint adds insufficient permissions

packages/@aws-cdk/aws-stepfunctions-tasks/lib/sagemaker/update-endpoint.ts

@@ -73,6 +73,13 @@ export class SageMakerUpdateEndpoint extends sfn.TaskStateBase {
             // SageMaker uses lowercase for resource name in the arn
             resourceName: sfn.JsonPath.isEncodedJsonPath(this.props.endpointName) ? '*' : `${this.props.endpointName.toLowerCase()}`,
           }),
+          stack.formatArn({
+            service: 'sagemaker',
+            resource: 'endpoint-config',
+            // If the endpointConfig name comes from input, we cannot target the policy to a particular ARN prefix reliably.
+            // SageMaker uses lowercase for resource name in the arn
+            resourceName: sfn.JsonPath.isEncodedJsonPath(this.props.endpointConfigName) ? '*' : `${this.props.endpointConfigName.toLowerCase()}`,
+          }),
         ],
       }),
     ];

packages/@aws-cdk/aws-stepfunctions-tasks/test/sagemaker/integ.call-sagemaker.expected.json

@@ -465,26 +465,48 @@
             {
               "Action": "sagemaker:updateEndpoint",
               "Effect": "Allow",
-              "Resource": {
-                "Fn::Join": [
-                  "",
-                  [
-                    "arn:",
-                    {
-                      "Ref": "AWS::Partition"
-                    },
-                    ":sagemaker:",
-                    {
-                      "Ref": "AWS::Region"
-                    },
-                    ":",
-                    {
-                      "Ref": "AWS::AccountId"
-                    },
-                    ":endpoint/*"
+              "Resource": [
+                {
+                  "Fn::Join": [
+                    "",
+                    [
+                      "arn:",
+                      {
+                        "Ref": "AWS::Partition"
+                      },
+                      ":sagemaker:",
+                      {
+                        "Ref": "AWS::Region"
+                      },
+                      ":",
+                      {
+                        "Ref": "AWS::AccountId"
+                      },
+                      ":endpoint/*"
+                    ]
                   ]
-                ]
-              }
+                },
+                {
+                  "Fn::Join": [
+                    "",
+                    [
+                      "arn:",
+                      {
+                        "Ref": "AWS::Partition"
+                      },
+                      ":sagemaker:",
+                      {
+                        "Ref": "AWS::Region"
+                      },
+                      ":",
+                      {
+                        "Ref": "AWS::AccountId"
+                      },
+                      ":endpoint-config/*"
+                    ]
+                  ]
+                }
+              ]
             }
           ],
           "Version": "2012-10-17"

packages/@aws-cdk/aws-stepfunctions-tasks/test/sagemaker/update-endpoint.test.ts

@@ -1,4 +1,5 @@
 import '@aws-cdk/assert/jest';
+import * as iam from '@aws-cdk/aws-iam';
 import * as sfn from '@aws-cdk/aws-stepfunctions';
 import * as cdk from '@aws-cdk/core';
 import * as tasks from '../../lib';
@@ -80,3 +81,65 @@ test('Task throws if WAIT_FOR_TASK_TOKEN is supplied as service integration patt
     });
   }).toThrow(/Unsupported service integration pattern. Supported Patterns: REQUEST_RESPONSE. Received: WAIT_FOR_TASK_TOKEN/i);
 });
+
+test('PolicyStatement has sufficient permissions', () => {
+  // WHEN
+  const props = {
+    endpointName: 'MyEndpoint',
+    endpointConfigName: 'MyEndpointConfig',
+  };
+  const task = new tasks.SageMakerUpdateEndpoint(stack, 'SagemakerEndpoint', props);
+
+  const graph = new sfn.StateGraph(task, 'test');
+
+  // THEN
+  expect(graph.policyStatements).toEqual(
+    [
+      new iam.PolicyStatement({
+        actions: ['sagemaker:updateEndpoint'],
+        resources: [
+          stack.formatArn({
+            service: 'sagemaker',
+            resource: 'endpoint',
+            resourceName: props.endpointName.toLowerCase(),
+          }),
+          stack.formatArn({
+            service: 'sagemaker',
+            resource: 'endpoint-config',
+            resourceName: props.endpointConfigName.toLowerCase(),
+          }),
+        ],
+      }),
+    ],
+  );
+
+  // WHEN
+  const props2 = {
+    endpointName: sfn.JsonPath.stringAt('$.Endpoint.Name'),
+    endpointConfigName: sfn.JsonPath.stringAt('$.Endpoint.Config'),
+  };
+  const task2 = new tasks.SageMakerUpdateEndpoint(stack, 'SagemakerEndpoint2', props2);
+
+  const graph2 = new sfn.StateGraph(task2, 'test');
+
+  // THEN
+  expect(graph2.policyStatements).toEqual(
+    [
+      new iam.PolicyStatement({
+        actions: ['sagemaker:updateEndpoint'],
+        resources: [
+          stack.formatArn({
+            service: 'sagemaker',
+            resource: 'endpoint',
+            resourceName: '*',
+          }),
+          stack.formatArn({
+            service: 'sagemaker',
+            resource: 'endpoint-config',
+            resourceName: '*',
+          }),
+        ],
+      }),
+    ],
+  );
+});