What problem does it solve? SageMaker deployments commonly fail because no usable execution role exists, or because scripts try to create a new role when the caller (often an SSO principal) lacks IAM permissions. This Skill enforces the correct order — discover existing roles, validate their trust policy, and only create a role when nothing usable exists. ## Core Features & Use Cases - Role Discovery and Ranking: Searches the AWS account for SageMaker execution roles, ranks candidates by last-used date (falling back to creation date), and returns the first role whose trust policy allows sagemaker.amazonaws.com. - Role Validation: Validates a user-supplied role name or ARN, confirming it exists and trusts the SageMaker service principal, printing the ARN on success. - Guarded Role Creation: Creates a role with the canonical trust policy, attaches AmazonSageMakerFullAccess, and applies a minimum-permissions inline policy scoped to a specific S3 model bucket, while warning when the caller is an SSO principal likely to hit AccessDenied. - Use Case: Before creating a SageMaker endpoint, run the discovery helper to find an existing execution role ARN instead of failing mid-deployment with IAM errors. ## Quick Start Ask the assistant to find or validate a SageMaker execution role in my AWS account before I create a model or endpoint.
