What does this skill do, and when should you use it?
This skill checks for a usable SageMaker execution role before creating endpoints, models, training jobs, or other role-dependent resources. It validates a user-supplied role first, then discovers existing SageMaker-style roles and ranks them by recent use. Role creation is considered only when discovery finds nothing and the caller has the required IAM permissions. It is a good fit for AWS CLI-based workflows that need to avoid predictable failures from SSO principals without IAM write access.
Runs Python helper scripts to validate a named role or ARN, or discover existing roles matching common SageMaker naming patterns. It ranks candidates by RoleLastUsed and falls back to CreateDate when last-used data is unavailable. It verifies that the role exists and that its trust policy allows sagemaker.amazonaws.com to call sts:AssumeRole, then prints a usable ARN on success. If no role is found, it provides separate paths for users who can create roles and SSO users who must obtain an ARN or permissions from an AWS administrator. It also documents equivalent AWS CLI commands for manual discovery and validation.
- A developer is deploying a SageMaker endpoint without an explicit execution-role ARN.
- A machine-learning engineer is preparing a SageMaker model or training job and wants a role check before deployment code runs.
- An AWS SSO user receives an IAM AccessDenied error and needs to distinguish a missing role from missing creation permissions.
- An operations team has several SageMaker roles and wants to prefer the recently used, potentially maintained role.
- A user needs the same preflight workflow on Windows PowerShell, macOS, or Linux.
How do you install this skill?
- create_role.py attaches AmazonSageMakerFullAccess; perform a manual least-privilege review before execution.
- Role creation, managed-policy attachment, and inline-policy creation have no transactional rollback; partial failures may leave resources configured.
- Trust validation uses substring matching and does not strictly verify Principal, Action, or conditions.
- The skill depends on a working local AWS CLI, credentials, and reachable AWS services; mainland-China network reachability and Chinese-language support are not documented.
- Shell / CLI
- Network access
- Local filesystem
PythonAWS CLI
Copy or symlink the hf-cloud-sagemaker-iam-preflight folder from the repository's skills/ directory into a standard Codex .agents/skills location, such as $REPO_ROOT/.agents/skills or $HOME/.agents/skills. The README does not document a standalone installation command for this individual skill.
tmp="$(mktemp -d)"
git clone --depth 1 https://github.com/huggingface/skills.git "$tmp"
mkdir -p ~/.claude/skills
cp -R "$tmp/skills/hf-cloud-sagemaker-iam-preflight" ~/.claude/skills/
rm -rf "$tmp"Generated from the source repository and skill path; it copies only this skill's folder. If the author's install steps above differ, follow those first. To scope it to one project, replace ~/.claude/skills with that project's .claude/skills.
How do you use this skill?
Once installed, send your agent any of these to trigger it:
- Before creating this SageMaker training job, use the SageMaker IAM preflight skill to check and validate the execution role.
Run the helpers from the same shell where AWS CLI identity works with aws sts get-caller-identity. Validate a supplied role with python3 scripts/check_role.py "<role-name-or-arn>", or discover roles with python3 scripts/check_role.py. On Windows PowerShell, use python scripts/check_role.py directly. A suitable trigger is: “Before creating this SageMaker training job, use the SageMaker IAM preflight skill to check and validate the execution role.” If discovery finds nothing and the user has IAM permissions, run python3 scripts/create_role.py "<role-name>" "<model-bucket>". For an SSO principal without creation permissions, stop and request an administrator-provided role ARN or the required IAM grants.
What are this skill's strengths and limitations?
- Enforces discovery and validation before role creation.
- Ranks existing roles by recent use and falls back to creation date when needed.
- Checks the SageMaker trust relationship that is required for role assumption.
- Uses Python helpers across Windows, macOS, and Linux and includes a native AWS CLI fallback.
- Gives concrete remediation guidance for SSO users without IAM write permissions.
- Does not deeply simulate or verify all role permissions.
- Requires Python, AWS CLI, working credentials, and network access to AWS.
- The source provides no test suite, version pinning, or standalone package.
- Role creation remains dependent on the caller having the necessary IAM permissions.
How does this skill compare with similar options?
Side by side with related skills; every score comes from the same FSRS standard.
| Skill | FS score | Stars | Last updated | License |
|---|---|---|---|---|
| SageMaker IAM Preflight this page | 41 · Not recommended | ★ 11k | 18d ago | Apache-2.0 |
| AWS Context Discovery | 50 · Use with care | ★ 11k | 18d ago | Apache-2.0 |
| SageMaker Python Environment Setup | 49 · Use with care | ★ 11k | 18d ago | Apache-2.0 |
| SageMaker Production Defaults | 46 · Use with care | ★ 11k | 18d ago | Apache-2.0 |
| Google Cloud Developer Onboarding ✓ Google · Official | 42 · Not recommended | ★ 21k | 12d ago | Apache-2.0 |
The documented Native AWS CLI equivalent is a manual alternative to the Python helpers: users list candidate roles, inspect trust policies, and compare last-used or creation dates themselves.
How did FollowSkills review this skill?
The skill requires discovery and validation before creation and documents AWS credential inheritance and failure feedback. However, creation lacks explicit user confirmation and rollback, defaults to attaching AmazonSageMakerFullAccess, and the supplemental policy still uses wildcard resources for ECR and CloudWatch, so least-privilege deductions are substantial.
The two Python helpers have coherent parameters, exit codes, failure paths, and native CLI fallback guidance. However, trust validation is only a substring check, partial creation failures leave resources behind, and no key-path tests are present; under static calibration the score stays at or below 10.
Triggers, inputs, Windows versus Unix guidance, and the SSO scenario are relatively clear. The skill is narrowly limited to SageMaker IAM preflight, gives little explicit non-fit guidance, and provides no Chinese-language or mainland-China reachability support, so points are deducted.
The folder contains a SKILL.md, scripts, JSON references, usage guidance, permission notes, limitations, an Apache-2.0 license, and repository CI. It lacks skill-specific versioning, changelog, named maintenance responsibility, and a clear update path, with limited examples and troubleshooting coverage.
It can discover and return a usable execution-role ARN or provide actionable SSO escalation guidance, completing the core preflight task. It only checks existence and trust rather than effective permissions; the creation path uses an overly broad policy and lacks confirmation and recovery, so manual review remains necessary.
The supplied files make the logic and policy templates auditable, and repository CI validates generated artifacts and version bumps. There are no committed tests covering this skill's key paths or third-party execution records, so static evidence supports no more than 5 points.
Open a dimension to read why it scored that way
Evidence confidence：Low — Mostly static review, author material or a limited demo; useful for discovery, not high-risk decisions.
See the full review method →