Secure your code as it's written. Use Snyk Code to scan source code in minutes - no build needed - and fix issues immediately.
private makePolicyStatements(task: sfn.Task): iam.PolicyStatement[] {
const stack = Stack.of(task);
// https://docs.aws.amazon.com/step-functions/latest/dg/sagemaker-iam.html
const policyStatements = [
new iam.PolicyStatement({
actions: ['sagemaker:CreateTrainingJob', 'sagemaker:DescribeTrainingJob', 'sagemaker:StopTrainingJob'],
resources: [
stack.formatArn({
service: 'sagemaker',
resource: 'training-job',
// If the job name comes from input, we cannot target the policy to a particular ARN prefix reliably...
resourceName: sfn.Data.isJsonPathString(this.props.trainingJobName) ? '*' : `${this.props.trainingJobName}*`
})
],
}),
new iam.PolicyStatement({
actions: ['sagemaker:ListTags'],
resources: ['*']
}),
new iam.PolicyStatement({
actions: ['iam:PassRole'],
resources: [this._role!.roleArn],
conditions: {
StringEquals: { "iam:PassedToService": "sagemaker.amazonaws.com" }
}
})
];
(acc, m) => ({
...acc,
[m]: sfn.Data.stringAt(m) // It's okay to always use `stringAt` here
}),
{}