SageMaker IAM Role Preflight
huggingface/skills
Finds or validates a usable SageMaker execution role before deploying or training, so scripts do not try to create IAM roles they lack permission to create.
Verify or select a SageMaker execution role before creating models, endpoints, or training jobs.
$ npx skills add waybarrios/opencode-power-pack --skill hf-cloud-sagemaker-iam-preflight -a claude-codeProject install by default; add -g for ~/.claude/skills/.
$ gh skill install waybarrios/opencode-power-pack hf-cloud-sagemaker-iam-preflight --agent claude-codeProject scope by default; add --scope user for a personal install. Needs GitHub CLI 2.90.0 or later (public preview).
$ git clone --depth 1 https://github.com/waybarrios/opencode-power-pack.git skills-src && mkdir -p .claude/skills && cp -r skills-src/skills/hf-cloud-sagemaker-iam-preflight .claude/skills/hf-cloud-sagemaker-iam-preflight && rm -rf skills-srcUse ~/.claude/skills/ instead of .claude/skills for a personal install. The folder must contain SKILL.md.
Claude Code skills documentation · loads skills from .claude/skills/
Install the "hf-cloud-sagemaker-iam-preflight" agent skill from https://github.com/waybarrios/opencode-power-pack/tree/main/skills/hf-cloud-sagemaker-iam-preflight into .claude/skills/hf-cloud-sagemaker-iam-preflight/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "hf-cloud-sagemaker-iam-preflight", then confirm the skill loads.Claude Code copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$skill-installer install https://github.com/waybarrios/opencode-power-pack/tree/main/skills/hf-cloud-sagemaker-iam-preflightType this inside Codex. $skill-installer <name> installs a curated skill from openai/skills. The installer writes to $CODEX_HOME/skills (default ~/.codex/skills). Restart Codex if the skill does not show up.
$ npx skills add waybarrios/opencode-power-pack --skill hf-cloud-sagemaker-iam-preflight -a codexProject install goes to .agents/skills/; add -g for ~/.codex/skills/.
$ gh skill install waybarrios/opencode-power-pack hf-cloud-sagemaker-iam-preflight --agent codexProject scope by default (.agents/skills/); add --scope user for a personal install.
$ git clone --depth 1 https://github.com/waybarrios/opencode-power-pack.git skills-src && mkdir -p .agents/skills && cp -r skills-src/skills/hf-cloud-sagemaker-iam-preflight .agents/skills/hf-cloud-sagemaker-iam-preflight && rm -rf skills-srcUse ~/.agents/skills/ instead of .agents/skills for a personal install.
Codex skills documentation · loads skills from .agents/skills/
Install the "hf-cloud-sagemaker-iam-preflight" agent skill from https://github.com/waybarrios/opencode-power-pack/tree/main/skills/hf-cloud-sagemaker-iam-preflight into .agents/skills/hf-cloud-sagemaker-iam-preflight/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "hf-cloud-sagemaker-iam-preflight", then confirm the skill loads.Codex copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$ npx skills add waybarrios/opencode-power-pack --skill hf-cloud-sagemaker-iam-preflight -a cursorProject install goes to .agents/skills/; add -g for ~/.cursor/skills/.
$ gh skill install waybarrios/opencode-power-pack hf-cloud-sagemaker-iam-preflight --agent cursorProject scope by default (.agents/skills/); add --scope user for a personal install.
$ git clone --depth 1 https://github.com/waybarrios/opencode-power-pack.git skills-src && mkdir -p .cursor/skills && cp -r skills-src/skills/hf-cloud-sagemaker-iam-preflight .cursor/skills/hf-cloud-sagemaker-iam-preflight && rm -rf skills-srcUse ~/.cursor/skills/ instead of .cursor/skills for a personal install.
Cursor skills documentation · loads skills from .cursor/skills/, .agents/skills/, .claude/skills/, .codex/skills/
Install the "hf-cloud-sagemaker-iam-preflight" agent skill from https://github.com/waybarrios/opencode-power-pack/tree/main/skills/hf-cloud-sagemaker-iam-preflight into .cursor/skills/hf-cloud-sagemaker-iam-preflight/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "hf-cloud-sagemaker-iam-preflight", then confirm the skill loads.Cursor copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$ gemini skills install https://github.com/waybarrios/opencode-power-pack.git --path skills/hf-cloud-sagemaker-iam-preflight--scope user (default) or --scope workspace; --path is the subfolder of the repo that holds the skill; --consent skips the security confirmation prompt.
$ npx skills add waybarrios/opencode-power-pack --skill hf-cloud-sagemaker-iam-preflight -a gemini-cliProject install goes to .agents/skills/; add -g for ~/.gemini/skills/.
$ gh skill install waybarrios/opencode-power-pack hf-cloud-sagemaker-iam-preflight --agent gemini-cliProject scope by default (.agents/skills/); add --scope user for a personal install.
$ git clone --depth 1 https://github.com/waybarrios/opencode-power-pack.git skills-src && mkdir -p .gemini/skills && cp -r skills-src/skills/hf-cloud-sagemaker-iam-preflight .gemini/skills/hf-cloud-sagemaker-iam-preflight && rm -rf skills-srcUse ~/.gemini/skills/ instead of .gemini/skills for a personal install, then run /skills reload.
Gemini CLI skills documentation · loads skills from .gemini/skills/, .agents/skills/
Install the "hf-cloud-sagemaker-iam-preflight" agent skill from https://github.com/waybarrios/opencode-power-pack/tree/main/skills/hf-cloud-sagemaker-iam-preflight into .gemini/skills/hf-cloud-sagemaker-iam-preflight/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "hf-cloud-sagemaker-iam-preflight", then confirm the skill loads.Gemini CLI copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$ gh skill install waybarrios/opencode-power-pack hf-cloud-sagemaker-iam-preflightInstalls for Copilot at project scope by default; add --scope user for a personal install. Preview a skill first with gh skill preview. Needs GitHub CLI 2.90.0 or later (public preview).
$ npx skills add waybarrios/opencode-power-pack --skill hf-cloud-sagemaker-iam-preflight -a github-copilotProject install goes to .agents/skills/; add -g for ~/.copilot/skills/.
$ git clone --depth 1 https://github.com/waybarrios/opencode-power-pack.git skills-src && mkdir -p .github/skills && cp -r skills-src/skills/hf-cloud-sagemaker-iam-preflight .github/skills/hf-cloud-sagemaker-iam-preflight && rm -rf skills-srcUse ~/.copilot/skills/ instead of .github/skills for a personal install. Commit .github/skills so cloud agent and code review can use it.
GitHub Copilot skills documentation · loads skills from .github/skills/, .claude/skills/, .agents/skills/
Install the "hf-cloud-sagemaker-iam-preflight" agent skill from https://github.com/waybarrios/opencode-power-pack/tree/main/skills/hf-cloud-sagemaker-iam-preflight into .github/skills/hf-cloud-sagemaker-iam-preflight/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "hf-cloud-sagemaker-iam-preflight", then confirm the skill loads.GitHub Copilot copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$ npx skills add waybarrios/opencode-power-pack --skill hf-cloud-sagemaker-iam-preflight -a opencodeOpenCode documents no install command of its own. Project install goes to .agents/skills/; add -g for ~/.config/opencode/skills/.
$ gh skill install waybarrios/opencode-power-pack hf-cloud-sagemaker-iam-preflight --agent opencodeProject scope by default (.agents/skills/); add --scope user for a personal install.
$ git clone --depth 1 https://github.com/waybarrios/opencode-power-pack.git skills-src && mkdir -p .opencode/skills && cp -r skills-src/skills/hf-cloud-sagemaker-iam-preflight .opencode/skills/hf-cloud-sagemaker-iam-preflight && rm -rf skills-srcUse ~/.config/opencode/skills/ instead of .opencode/skills for a personal install.
OpenCode skills documentation · loads skills from .opencode/skills/, .claude/skills/, .agents/skills/
Install the "hf-cloud-sagemaker-iam-preflight" agent skill from https://github.com/waybarrios/opencode-power-pack/tree/main/skills/hf-cloud-sagemaker-iam-preflight into .opencode/skills/hf-cloud-sagemaker-iam-preflight/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "hf-cloud-sagemaker-iam-preflight", then confirm the skill loads.OpenCode copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
hf-cloud-sagemaker-iam-preflightVerify or select a SageMaker execution role before creating models, endpoints, or training jobs.
Hf Cloud Sagemaker Iam Preflight is an agent skill from waybarrios/opencode-power-pack. Verify or select a SageMaker execution role before creating models, endpoints, or training jobs. Use when a role ARN is missing or IAM access fails; inspect existing roles before proposing role creation.
Its SKILL.md is about 1.6k tokens, which your agent loads only when the skill is triggered. The skill folder holds 6 other files, including scripts and reference files (for example `references/minimum-permissions.json`, `references/trust-policy.json` and `scripts/check_role.py`).
It sits in Security. It works with Amazon SageMaker, Amazon Web Services, Bash and PowerShell. The repository describes itself as: 54 rigorous skills for Codex, OpenCode, and Pi: code review, security audit, feature development, frontend design, MCP tools, Hugging Face ML/training, and more. The licence is Apache-2.0.
3 steps, taken from the step headings in SKILL.md.
Read from SKILL.md and the folder at commit 9dccb6d. It shows what the files ask for, not the result of running them.
Pre-approves nothing: there is no allowed-tools line, so your agent's usual permission prompts apply.
From allowed-tools in the SKILL.md frontmatter.
Ships 2 files in scripts/ (Python), which the agent can run.
Shell commands in SKILL.md call:
awspython3pythonFrom the folder's file list and the shell code blocks in SKILL.md.
No URLs in SKILL.md. Its commands use aws, which can reach the network depending on how they are called.
From URLs in SKILL.md, links to its own repository left out.
Names no API keys, tokens, secrets or passwords.
From names ending in _API_KEY, _TOKEN, _SECRET, _KEY or _PASSWORD in SKILL.md.
Hf Cloud Sagemaker Iam Preflight loads about 1.6k tokens when it runs, and up to ~1.9k if it reads all its reference files. Until then it costs about 59 tokens; SKILL.md has 739 words of instructions outside code blocks.
Estimates: characters ÷ 4, the usual rule of thumb; real counts depend on the model's tokenizer. Scripts and assets cost tokens only if the agent reads them.
The automated check found no risky patterns in SKILL.md.
Automated static check — not a guarantee. Review scripts before installing. It scans the text of SKILL.md for risky patterns (piping downloads into a shell, reading credential files, hidden Unicode, destructive commands); the scripts in this folder are not scanned.
The full file from waybarrios/opencode-power-pack at commit 9dccb6d, republished under its Apache-2.0 licence (© waybarrios). 739 words, ~1,604 tokens.
.claude/skills/hf-cloud-sagemaker-iam-preflight/SKILL.md (or your agent's skills folder). This skill also uses 4 other files; get the full folder from GitHub.Every SageMaker resource needs an execution role — the IAM role SageMaker assumes to read model artifacts from S3, pull serving containers from ECR, and write logs. Most deployments fail here because the script tried to create a new role without checking if a usable one already existed, then blew up because the caller is an SSO principal.
This skill encodes the right order: discover, validate, only create if necessary.
The helpers are Python so they run identically on Windows, macOS, and Linux:
python3 scripts/check_role.py # macOS / Linux
python scripts/check_role.py # Windows (PowerShell / cmd)Run them from the shell where the AWS CLI already works — i.e. wherever aws sts get-caller-identity succeeds. The script shells out to that same aws binary and inherits the shell's profile, region, SSO session, proxy, and credential chain.
Windows / WSL / Git Bash caveat. Do not invoke these through a Bash shim (WSL, Git Bash, MSYS) on Windows. Those Bash environments frequently do not share the Windows AWS config, credentials, SSO sessions, environment variables, or proxy settings — so
aws sts get-caller-identityfails inside Bash even when it works natively in PowerShell. (This is exactly why the old.shhelpers failed on Windows and were replaced with Python.) If you're in PowerShell, runpython ...\check_role.pydirectly in PowerShell. If the helper still can't see your identity, run the same discovery natively (see "Native AWS CLI equivalent" below) in the shell whereaws sts get-caller-identityreturns your ARN.
Validate that one specifically:
python3 scripts/check_role.py "<role-name-or-arn>"On success it prints the ARN to stdout (exit 0). On failure it logs why on stderr. Don't try to silently fix a broken role — surface the problem.
python3 scripts/check_role.pyLists roles matching common SageMaker patterns (AmazonSageMaker-ExecutionRole-*, SageMakerExecutionRole*, etc.), ranks by last-used date (most recent first), validates trust policy in that order, returns the first usable ARN. Most accounts that have used SageMaker before already have one.
Why rank by last-used: in accounts with multiple roles (auto-generated 2021 role + manual project role + etc.), the alphabetically-first one is rarely the actively-maintained one. The most-recently-used role is more likely to have current policies — including cross-account ECR pull. The script prints the ranking so you can see which got picked.
IAM frequently reports no RoleLastUsed at all (tracking only covers recent activity). When every candidate ties at "never used", the script falls back to newest creation date — a newer role is more likely to have current policies than a 2021 leftover.
If the user can create (has IAM permissions):
python3 scripts/create_role.py "<role-name>" "<model-bucket>"Second arg scopes S3 access to a specific bucket. Omit if unknown; script warns and the user can update the policy later.
If the user cannot create (SSO principal — hf-cloud-aws-context-discovery will have flagged this):
Stop and surface this clearly. Don't retry alternative IAM operations hoping one works:
I can't find an existing SageMaker execution role, and you're authenticated via SSO so you can't create one directly. Please either:
- Ask your AWS admin for a SageMaker execution role ARN, or
- Have them grant your SSO permission set
iam:CreateRole,iam:AttachRolePolicy,iam:PutRolePolicy
Specific instructions get unblocked fast; vague "permission denied" messages don't.
A role is usable when (1) it exists, (2) its trust policy allows sagemaker.amazonaws.com to sts:AssumeRole — see references/trust-policy.json for the canonical form.
check_role.py verifies these two. It does not deep-check permissions because comprehensive analysis is expensive (iam:SimulatePrincipalPolicy per action) and most existing SageMaker roles are over-permissioned via AmazonSageMakerFullAccess. If you suspect a permissions issue at deploy time, the deployment error will tell you which action was denied — fix it then, not preemptively.
references/minimum-permissions.json covers what SageMaker actually needs:
s3:GetObject + s3:ListBucket on the model artifact bucketLayered on top of AmazonSageMakerFullAccess (attached by create_role.py). Replace REPLACE_WITH_MODEL_BUCKET in the template with the actual bucket name — create_role.py does this automatically when given a bucket as its second argument.
If the Python helper can't run or can't see your identity (rare — usually a broken PATH or running under a Bash shim that lacks AWS context), do the same preflight by hand in the shell where aws sts get-caller-identity works. The logic is just AWS CLI calls; the helper exists only to bundle and rank them.
PowerShell:
# 1. List candidate SageMaker roles
aws iam list-roles --query "Roles[?contains(RoleName,'SageMaker') || contains(RoleName,'sagemaker')]" --output json
# 2. For each candidate, confirm the trust policy allows sagemaker.amazonaws.com
aws iam get-role --role-name <role-name> --query "Role.AssumeRolePolicyDocument" --output json
# 3. Prefer the most-recently-used role with SageMaker-execution naming
# (LastUsedDate is often None for every role — then prefer newest CreateDate)
aws iam get-role --role-name <role-name> --query "Role.[RoleLastUsed.LastUsedDate, CreateDate]" --output textPick the most-recently-used role whose trust policy contains sagemaker.amazonaws.com. Use the resulting ARN exactly as if check_role.py had returned it. Bash/macOS/Linux use the same commands.
© waybarrios, Apache-2.0. Rendered from Markdown: HTML in the file is shown as text, images as links, and headings moved down two levels. Raw file
SKILL.md and 4 other files (scripts, references) in skills/hf-cloud-sagemaker-iam-preflight of waybarrios/opencode-power-pack.
Open the folder on GitHubat commit 9dccb6d
Hf Cloud Sagemaker Iam Preflight next to the 5 skills that share the most tags, products or categories with it. Stars are the repository's; “used in” counts other GitHub owners with a copy.
| Skill | Stars | Used in | Tokens | Auto-check | Licence | Repo updated |
|---|---|---|---|---|---|---|
| Hf Cloud Sagemaker Iam Preflight this skillwaybarrios/opencode-power-pack | 534 | — | ~1.6k | Automated safety check: Pass | Apache-2.0 | |
| SageMaker IAM Role Preflighthuggingface/skills | 11k | 1 repos | ~1.8k | Automated safety check: Pass | Apache-2.0 | |
| Python Environment Setup for SageMakerhuggingface/skills | 11k | 2 repos | ~1.7k | Automated safety check: Pass | Apache-2.0 | |
| Hyperpod Version Checkerawslabs/agent-plugins | 916 | — | ~910 | Automated safety check: Pass | Apache-2.0 | |
| SDK Getting Startedawslabs/agent-plugins | 916 | — | ~248 | Automated safety check: Pass | Apache-2.0 | |
| Jeecg Onlformjeecgboot/skills | 239 | — | ~7.7k | Automated safety check: Pass | Apache-2.0 |
huggingface/skills
Finds or validates a usable SageMaker execution role before deploying or training, so scripts do not try to create IAM roles they lack permission to create.
huggingface/skills
Sets up an isolated Python environment with a supported interpreter and current boto3 before any SageMaker deployment, training or AWS automation code runs.
awslabs/agent-plugins
Check and compare software component versions on SageMaker HyperPod cluster nodes - NVIDIA drivers, CUDA toolkit, cuDNN, NCCL, EFA, AWS OFI NCCL, GDRCopy, MPI, Neuron SDK (Trainium/Inferentia)…
awslabs/agent-plugins
Validates the user's environment for SageMaker AI operations — checks SDK version, AWS region, and execution role.
jeecgboot/skills
JeecgBoot Online表单(cgform)全生命周期管理——通过API自动创建/编辑数据库表和表单配置, 支持单表、主子表、树表,26种控件类型,以及JS/Java/SQL增强、权限配置、数据CRUD、积木报表集成。
tinyfish-io/tinyfish-cookbook
Find paid open-source work, OSS bounties, open source grants, or ways to get paid contributing to open source.
waybarrios/opencode-power-pack
Train or fine-tune language models with TRL or Unsloth on Hugging Face Jobs, including SFT, DPO, GRPO, reward models, and GGUF conversion.
waybarrios/opencode-power-pack
Train object-detection, image-classification, or SAM segmentation models on Hugging Face Jobs.
waybarrios/opencode-power-pack
Run CodeQL database creation and security queries, add data-extension models, or process CodeQL SARIF.
waybarrios/opencode-power-pack
Run Semgrep static analysis across a codebase, optionally using Semgrep Pro for cross-file taint analysis.
waybarrios/opencode-power-pack
Detects fail-open insecure defaults (hardcoded secrets, weak auth, permissive security) that allow apps to run insecurely in production.
waybarrios/opencode-power-pack
Train or fine-tune SentenceTransformer bi-encoders, CrossEncoder rerankers, or SparseEncoder models, including losses, negatives, evaluation, distillation, LoRA, and Matryoshka.
Categories
Verify or select a SageMaker execution role before creating models, endpoints, or training jobs. Hf Cloud Sagemaker Iam Preflight is an agent skill from waybarrios/opencode-power-pack. Verify or select a SageMaker execution role before creating models, endpoints, or training jobs.
Hf Cloud Sagemaker Iam Preflight fits situations like: A role ARN is missing; IAM access fails; inspect existing roles before proposing role creation.
Run `npx skills add waybarrios/opencode-power-pack --skill hf-cloud-sagemaker-iam-preflight -a claude-code`. Or copy the skill folder (skills/hf-cloud-sagemaker-iam-preflight in waybarrios/opencode-power-pack) into .claude/skills/hf-cloud-sagemaker-iam-preflight in your project. Claude Code loads it when a task matches its description.
Run `npx skills add waybarrios/opencode-power-pack --skill hf-cloud-sagemaker-iam-preflight -a codex`. Or copy the skill folder (skills/hf-cloud-sagemaker-iam-preflight in waybarrios/opencode-power-pack) into .agents/skills/hf-cloud-sagemaker-iam-preflight in your project. Codex loads it when a task matches its description.
Cursor, Gemini CLI, GitHub Copilot and OpenCode also load SKILL.md folders. With the skills CLI, run `npx skills add waybarrios/opencode-power-pack --skill hf-cloud-sagemaker-iam-preflight -a cursor` (or -a gemini-cli, github-copilot or opencode for the others). To copy it by hand, put the folder in .cursor/skills/hf-cloud-sagemaker-iam-preflight, .gemini/skills/hf-cloud-sagemaker-iam-preflight, .github/skills/hf-cloud-sagemaker-iam-preflight and .opencode/skills/hf-cloud-sagemaker-iam-preflight in your project.
Going by SKILL.md and its folder, Hf Cloud Sagemaker Iam Preflight needs Python for the scripts in its folder and the command-line tools its instructions call (aws, python3 and python). Our summary lists: Python 3.
SKILL.md contains no URLs. Any network use would come from the scripts or tools the agent runs. This is read from the text; nothing was executed.
Our automated static check of SKILL.md found no risky patterns, such as piping downloads into a shell, reading credential files or hidden Unicode. It is not a guarantee. The check reads SKILL.md only: the scripts in the folder are not scanned, so read them before running anything.
Hf Cloud Sagemaker Iam Preflight is published under the Apache-2.0 licence (declared in SKILL.md). It allows redistribution, so the full SKILL.md is shown on this page.
About 1.6k tokens (SKILL.md is roughly 6.4k characters). Agents keep only the skill's name and description in context until a task matches; then they load SKILL.md in full. Its references folder adds about 310 tokens, read only when the agent opens those files.
Skills that share tags, products or a category with Hf Cloud Sagemaker Iam Preflight: SageMaker IAM Role Preflight (huggingface/skills, 11k stars), Python Environment Setup for SageMaker (huggingface/skills, 11k stars), Hyperpod Version Checker (awslabs/agent-plugins, 916 stars) and SDK Getting Started (awslabs/agent-plugins, 916 stars). The comparison table on this page puts their stars, adoption, token cost, safety result and licence side by side.
waybarrios (a GitHub user) maintains it in waybarrios/opencode-power-pack, which has 534 GitHub stars. The repository holds 32 skills in this directory. The repository was last updated on October 6, 2026.
Source: waybarrios/opencode-power-pack on GitHub. Facts on this page come from the repository at the commit we read; the author's words are quoted as theirs.