Loading skill
Install any skill in seconds. Free to start, no credit card required.
Get Started Free →waybarrios/hf-cloud-sagemaker-iam-preflight
Ensure a usable SageMaker execution role exists before deploying or training.
Passed 15 of 21 test cases with the skill, and 10 of 21 without it.
and 5 more in the full report
6 fixed10 passed either way6 still failing0 broke
Tokens, turns and time describe resource use, not a dollar price.
One of 6 test cases the skill fixed. Same model, same prompt, with and without the skill.
We are manually running AWS CLI fallback commands to inspect a SageMaker role's activity and creation metadata. Provide the AWS CLI command query string to output a role's last used date and creation date.
| Checked | Without skill | With skill |
|---|---|---|
| Role.[RoleLastUsed.LastUsedDate, CreateDate] | Missed | Passed |
| Formats output as plain text rather than JSON or table. | Passed | Passed |
The instructions your model reads when the skill loads.
Every SageMaker resource needs an execution role — the IAM role SageMaker assumes to read model artifacts from S3, pull serving containers from ECR, and write logs. Most deployments fail here because the script tried to create a new role without checking if a usable one already existed, then blew up because the caller is an SSO principal.
This skill encodes the right order: discover, validate, only create if necessary.
The helpers are Python so they run identically on Windows, macOS, and Linux:
python3 scripts/check_role.py # macOS / Linux
python scripts/check_role.py # Windows (PowerShell / cmd)
Run them from the shell where the AWS CLI already works — i.e. wherever aws sts get-caller-identity succeeds. The script shells out to that same aws binary and inherits the shell's profile, region, SSO session, proxy, and credential chain.
Windows / WSL / Git Bash caveat. Do not invoke these through a Bash shim (WSL, Git Bash, MSYS) on Windows. Those Bash environments frequently do not share the Windows AWS config, credentials, SSO sessions, environment variables, or proxy settings — so
aws sts get-caller-identityfails inside Bash even when it works natively in PowerShell. (This is exactly why the old.shhelpers failed on Windows and were replaced with Python.) If you're in PowerShell, runpython ...\check_role.pydirectly in PowerShell. If the helper still can't see your identity, run the same discovery natively (see "Native AWS CLI equivalent" below) in the shell whereaws sts get-caller-identityreturns your ARN.
Validate that one specifically:
python3 scripts/check_role.py "<role-name-or-arn>"
On success it prints the ARN to stdout (exit 0). On failure it logs why on stderr. Don't try to silently fix a broken role — surface the problem.
python3 scripts/check_role.py
Lists roles matching common SageMaker patterns (AmazonSageMaker-ExecutionRole-*, SageMakerExecutionRole*, etc.), ranks by last-used date (most recent first), validates trust policy in that order, returns the first usable ARN. Most accounts that have used SageMaker before already have one.
Why rank by last-used: in accounts with multiple roles (auto-generated 2021 role + manual project role + etc.), the alphabetically-first one is rarely the actively-maintained one. The most-recently-used role is more likely to have current policies — including cross-account ECR pull. The script prints the ranking so you can see which got picked.
test cases passed, vs 10 / 21 without
More skills from the same source and nearby in the registry, with their headline benchmark lift.