[小ネタ] SageMaker HyperPod の実行ロールでおなじみの AmazonSageMakerClusterInstanceRolePolicy は sagemaker- から始まる S3 バケットのみ権限を持っている

Instance i-0c4022df984497be9 failed to provision with the following error: "Execution role provided does not have permissions to access the bucket s3://hyprpd-lustre-hyperpod-lifecycle-XXXXXXXXXXXX/config/. Please ensure that the role has minimum permissions to read the bucket (s3:ListBucket, s3:GetObject)." Note that multiple instances may be impacted.

[cloudshell-user@ip-10-134-21-86 ~]$ aws ssm start-session \
> --target sagemaker-cluster:7tg6o65u86i5_controller-group-i-0feb8f2b463f1793c

Starting session with SessionId: takakuni-fgii8cpoodhhxsisqrhctldbsi
# aws sts get-caller-identity
{
    "UserId": "AROAZCAS4AKS3WJ7DCAXX:SageMaker",
    "Account": "123456789012",
    "Arn": "arn:aws:sts::123456789012:assumed-role/hyprpd-lustre-hyperpod-role/SageMaker"
}
#

{
    "Effect": "Allow",
    "Action": [
        "ec2:CreateNetworkInterface",
        "ec2:CreateNetworkInterfacePermission",
        "ec2:DeleteNetworkInterface",
        "ec2:DeleteNetworkInterfacePermission",
        "ec2:DescribeNetworkInterfaces",
        "ec2:DescribeVpcs",
        "ec2:DescribeDhcpOptions",
        "ec2:DescribeSubnets",
        "ec2:DescribeSecurityGroups",
        "ec2:DetachNetworkInterface"
    ],
    "Resource": "*"
}
{
    "Effect": "Allow",
    "Action": "ec2:CreateTags",
    "Resource": [
        "arn:aws:ec2:*:*:network-interface/*"
    ]
}

{
	"Version": "2012-10-17",
	"Statement": [
		{
			"Sid": "CloudwatchLogStreamPublishPermissions",
			"Effect": "Allow",
			"Action": [
				"logs:PutLogEvents",
				"logs:CreateLogStream",
				"logs:DescribeLogStreams"
			],
			"Resource": [
				"arn:aws:logs:*:*:log-group:/aws/sagemaker/Clusters/*:log-stream:*"
			]
		},
		{
			"Sid": "CloudwatchLogGroupCreationPermissions",
			"Effect": "Allow",
			"Action": ["logs:CreateLogGroup"],
			"Resource": ["arn:aws:logs:*:*:log-group:/aws/sagemaker/Clusters/*"]
		},
		{
			"Sid": "CloudwatchPutMetricDataAccess",
			"Effect": "Allow",
			"Action": ["cloudwatch:PutMetricData"],
			"Resource": ["*"],
			"Condition": {
				"StringEquals": {
					"cloudwatch:namespace": "/aws/sagemaker/Clusters"
				}
			}
		},
		{
			"Sid": "DataRetrievalFromS3BucketPermissions",
			"Effect": "Allow",
			"Action": ["s3:ListBucket", "s3:GetObject"],
			"Resource": ["arn:aws:s3:::sagemaker-*"],
			"Condition": {
				"StringEquals": {
					"aws:ResourceAccount": "${aws:PrincipalAccount}"
				}
			}
		},
		{
			"Sid": "SSMConnectivityPermissions",
			"Effect": "Allow",
			"Action": [
				"ssmmessages:CreateControlChannel",
				"ssmmessages:CreateDataChannel",
				"ssmmessages:OpenControlChannel",
				"ssmmessages:OpenDataChannel"
			],
			"Resource": "*"
		}
	]
}