aws-cdk-example.ts

const ROLE_ARN = 'arn:aws:iam::aws:policy/AmazonSageMakerFullAccess';

const amazonSageMakerRole = new Role(this, 'AmazonSageMakerRole', {
  assumedBy: new ServicePrincipal(AMAZON_SAGEMAKER_PRINCIPAL),
  roleName: 'amazon-sagemaker-in-practice-workshop-role'
});

amazonSageMakerRole.attachManagedPolicy(ROLE_ARN);

const participantsGroup = 
  new Group(this, 'AmazonSageMakerInPracticeParticipants');
const policy = 
  new Policy(this, 'AmazonSageMakerInPracticeParticipantsPolicy');

const permissions = [
  "sagemaker:*", "ecr:*", "cloudwatch:*", "logs:*",
  "s3:GetBucketLocation", "s3:ListAllMyBuckets",
  "iam:ListRoles", "iam:GetRole"
];

const defaultStatement = 
  (new PolicyStatement())
    .allow()
    .addAllResources()
    .addActions(...permissions);

const condition = { 'iam:PassedToService': AMAZON_SAGEMAKER_PRINCIPAL };
const passRole = 
  (new PolicyStatement())
    .allow()
    .addAllResources()
    .addAction("iam:PassRole")
    .addCondition("StringEquals", condition);

policy.addStatement(defaultStatement);
policy.addStatement(passRole);

participantsGroup.attachInlinePolicy(policy);

const dataSource = Bucket.import(this, 'DataSourceBucket', {
  bucketArn: 'arn:aws:s3:::amazon-sagemaker-in-practice-workshop'
});