[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill-huggingface-hf-cloud-sagemaker-iam-preflight":3,"mdc-cieunc-key":36,"related-repo-huggingface-hf-cloud-sagemaker-iam-preflight":786,"related-org-huggingface-hf-cloud-sagemaker-iam-preflight":876},{"slug":4,"name":4,"fn":5,"description":6,"org":7,"tags":11,"stars":25,"repoUrl":26,"updatedAt":27,"license":28,"forks":29,"topics":30,"repo":31,"sourceUrl":34,"mdContent":35},"hf-cloud-sagemaker-iam-preflight","configure SageMaker IAM roles","Ensure a usable SageMaker execution role exists before deploying or training. Use this skill whenever about to create a SageMaker endpoint, model, training job, or any resource that requires an execution role. Use it especially when the user has not provided a role ARN explicitly, when scripts are about to call `iam:CreateRole`, or when an AccessDenied error mentions an IAM action. Never blindly call `iam:CreateRole` — always check for existing roles first. This skill prevents the most common SageMaker deployment failure: trying to create IAM resources from an SSO principal that has no IAM write permissions.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},"huggingface","Hugging Face","https:\u002F\u002Fpexgzepcugksgbtrxkhf.supabase.co\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Forg-logos\u002Fhuggingface.png",[12,16,19,22],{"name":13,"slug":14,"type":15},"Security","security","tag",{"name":17,"slug":18,"type":15},"Permissions","permissions",{"name":20,"slug":21,"type":15},"AI Infrastructure","ai-infrastructure",{"name":23,"slug":24,"type":15},"AWS","aws",10861,"https:\u002F\u002Fgithub.com\u002Fhuggingface\u002Fskills","2026-07-08T05:55:34.948771",null,721,[],{"repoUrl":26,"stars":25,"forks":29,"topics":32,"description":33},[],"Give your agents the power of the Hugging Face ecosystem","https:\u002F\u002Fgithub.com\u002Fhuggingface\u002Fskills\u002Ftree\u002FHEAD\u002Fskills\u002Fhf-cloud-sagemaker-iam-preflight","---\nname: hf-cloud-sagemaker-iam-preflight\ndescription: 'Ensure a usable SageMaker execution role exists before deploying or training. Use this skill whenever about to create a SageMaker endpoint, model, training job, or any resource that requires an execution role. Use it especially when the user has not provided a role ARN explicitly, when scripts are about to call `iam:CreateRole`, or when an AccessDenied error mentions an IAM action. Never blindly call `iam:CreateRole` — always check for existing roles first. This skill prevents the most common SageMaker deployment failure: trying to create IAM resources from an SSO principal that has no IAM write permissions.'\n---\n\n# SageMaker IAM Preflight\n\nEvery SageMaker resource needs an **execution role** — the IAM role SageMaker assumes to read model artifacts from S3, pull serving containers from ECR, and write logs. Most deployments fail here because the script tried to create a new role without checking if a usable one already existed, then blew up because the caller is an SSO principal.\n\nThis skill encodes the right order: discover, validate, only create if necessary.\n\n## Running the helpers (cross-platform)\n\nThe helpers are Python so they run identically on Windows, macOS, and Linux:\n\n```bash\npython3 scripts\u002Fcheck_role.py        # macOS \u002F Linux\npython  scripts\u002Fcheck_role.py        # Windows (PowerShell \u002F cmd)\n```\n\n**Run them from the shell where the AWS CLI already works** — i.e. wherever `aws sts get-caller-identity` succeeds. The script shells out to that same `aws` binary and inherits the shell's profile, region, SSO session, proxy, and credential chain.\n\n> **Windows \u002F WSL \u002F Git Bash caveat.** Do **not** invoke these through a Bash shim (WSL, Git Bash, MSYS) on Windows. Those Bash environments frequently do **not** share the Windows AWS config, credentials, SSO sessions, environment variables, or proxy settings — so `aws sts get-caller-identity` fails inside Bash even when it works natively in PowerShell. (This is exactly why the old `.sh` helpers failed on Windows and were replaced with Python.) If you're in PowerShell, run `python ...\\check_role.py` directly in PowerShell. If the helper still can't see your identity, run the same discovery natively (see \"Native AWS CLI equivalent\" below) in the shell where `aws sts get-caller-identity` returns your ARN.\n\n## Order of operations\n\n### Step 1 — Did the user provide a role?\n\nValidate that one specifically:\n\n```bash\npython3 scripts\u002Fcheck_role.py \"\u003Crole-name-or-arn>\"\n```\n\nOn success it prints the ARN to stdout (exit 0). On failure it logs why on stderr. Don't try to silently fix a broken role — surface the problem.\n\n### Step 2 — Discover existing roles\n\n```bash\npython3 scripts\u002Fcheck_role.py\n```\n\nLists roles matching common SageMaker patterns (`AmazonSageMaker-ExecutionRole-*`, `SageMakerExecutionRole*`, etc.), **ranks by last-used date** (most recent first), validates trust policy in that order, returns the first usable ARN. Most accounts that have used SageMaker before already have one.\n\nWhy rank by last-used: in accounts with multiple roles (auto-generated 2021 role + manual project role + etc.), the alphabetically-first one is rarely the actively-maintained one. The most-recently-used role is more likely to have current policies — including cross-account ECR pull. The script prints the ranking so you can see which got picked.\n\nIAM frequently reports **no** `RoleLastUsed` at all (tracking only covers recent activity). When every candidate ties at \"never used\", the script falls back to **newest creation date** — a newer role is more likely to have current policies than a 2021 leftover.\n\n### Step 3 — Create, only if discovery found nothing\n\n**If the user can create** (has IAM permissions):\n\n```bash\npython3 scripts\u002Fcreate_role.py \"\u003Crole-name>\" \"\u003Cmodel-bucket>\"\n```\n\nSecond arg scopes S3 access to a specific bucket. Omit if unknown; script warns and the user can update the policy later.\n\n**If the user cannot create** (SSO principal — `hf-cloud-aws-context-discovery` will have flagged this):\n\nStop and surface this clearly. Don't retry alternative IAM operations hoping one works:\n\n> I can't find an existing SageMaker execution role, and you're authenticated via SSO so you can't create one directly. Please either:\n>   - Ask your AWS admin for a SageMaker execution role ARN, or\n>   - Have them grant your SSO permission set `iam:CreateRole`, `iam:AttachRolePolicy`, `iam:PutRolePolicy`\n\nSpecific instructions get unblocked fast; vague \"permission denied\" messages don't.\n\n## What \"validated\" means\n\nA role is usable when (1) it exists, (2) its trust policy allows `sagemaker.amazonaws.com` to `sts:AssumeRole` — see `references\u002Ftrust-policy.json` for the canonical form.\n\n`check_role.py` verifies these two. It does **not** deep-check permissions because comprehensive analysis is expensive (`iam:SimulatePrincipalPolicy` per action) and most existing SageMaker roles are over-permissioned via `AmazonSageMakerFullAccess`. If you suspect a permissions issue at deploy time, the deployment error will tell you which action was denied — fix it then, not preemptively.\n\n## Minimum permissions\n\n`references\u002Fminimum-permissions.json` covers what SageMaker actually needs:\n- `s3:GetObject` + `s3:ListBucket` on the model artifact bucket\n- ECR pull permissions\n- CloudWatch logs and metrics\n\nLayered on top of `AmazonSageMakerFullAccess` (attached by `create_role.py`). Replace `REPLACE_WITH_MODEL_BUCKET` in the template with the actual bucket name — `create_role.py` does this automatically when given a bucket as its second argument.\n\n## Native AWS CLI equivalent (fallback)\n\nIf the Python helper can't run or can't see your identity (rare — usually a broken PATH or running under a Bash shim that lacks AWS context), do the same preflight by hand in the shell where `aws sts get-caller-identity` works. The logic is just AWS CLI calls; the helper exists only to bundle and rank them.\n\nPowerShell:\n\n```powershell\n# 1. List candidate SageMaker roles\naws iam list-roles --query \"Roles[?contains(RoleName,'SageMaker') || contains(RoleName,'sagemaker')]\" --output json\n\n# 2. For each candidate, confirm the trust policy allows sagemaker.amazonaws.com\naws iam get-role --role-name \u003Crole-name> --query \"Role.AssumeRolePolicyDocument\" --output json\n\n# 3. Prefer the most-recently-used role with SageMaker-execution naming\n#    (LastUsedDate is often None for every role — then prefer newest CreateDate)\naws iam get-role --role-name \u003Crole-name> --query \"Role.[RoleLastUsed.LastUsedDate, CreateDate]\" --output text\n```\n\nPick the most-recently-used role whose trust policy contains `sagemaker.amazonaws.com`. Use the resulting ARN exactly as if `check_role.py` had returned it. Bash\u002FmacOS\u002FLinux use the same commands.\n",{"data":37,"body":38},{"name":4,"description":6},{"type":39,"children":40},"root",[41,50,64,69,76,81,136,161,218,224,231,236,270,275,281,300,328,333,360,366,376,422,427,445,450,493,498,504,533,566,572,583,615,650,656,668,673,761,780],{"type":42,"tag":43,"props":44,"children":46},"element","h1",{"id":45},"sagemaker-iam-preflight",[47],{"type":48,"value":49},"text","SageMaker IAM Preflight",{"type":42,"tag":51,"props":52,"children":53},"p",{},[54,56,62],{"type":48,"value":55},"Every SageMaker resource needs an ",{"type":42,"tag":57,"props":58,"children":59},"strong",{},[60],{"type":48,"value":61},"execution role",{"type":48,"value":63}," — the IAM role SageMaker assumes to read model artifacts from S3, pull serving containers from ECR, and write logs. Most deployments fail here because the script tried to create a new role without checking if a usable one already existed, then blew up because the caller is an SSO principal.",{"type":42,"tag":51,"props":65,"children":66},{},[67],{"type":48,"value":68},"This skill encodes the right order: discover, validate, only create if necessary.",{"type":42,"tag":70,"props":71,"children":73},"h2",{"id":72},"running-the-helpers-cross-platform",[74],{"type":48,"value":75},"Running the helpers (cross-platform)",{"type":42,"tag":51,"props":77,"children":78},{},[79],{"type":48,"value":80},"The helpers are Python so they run identically on Windows, macOS, and Linux:",{"type":42,"tag":82,"props":83,"children":88},"pre",{"className":84,"code":85,"language":86,"meta":87,"style":87},"language-bash shiki shiki-themes material-theme-lighter material-theme material-theme-palenight","python3 scripts\u002Fcheck_role.py        # macOS \u002F Linux\npython  scripts\u002Fcheck_role.py        # Windows (PowerShell \u002F cmd)\n","bash","",[89],{"type":42,"tag":90,"props":91,"children":92},"code",{"__ignoreMap":87},[93,117],{"type":42,"tag":94,"props":95,"children":98},"span",{"class":96,"line":97},"line",1,[99,105,111],{"type":42,"tag":94,"props":100,"children":102},{"style":101},"--shiki-light:#E2931D;--shiki-default:#FFCB6B;--shiki-dark:#FFCB6B",[103],{"type":48,"value":104},"python3",{"type":42,"tag":94,"props":106,"children":108},{"style":107},"--shiki-light:#91B859;--shiki-default:#C3E88D;--shiki-dark:#C3E88D",[109],{"type":48,"value":110}," scripts\u002Fcheck_role.py",{"type":42,"tag":94,"props":112,"children":114},{"style":113},"--shiki-light:#90A4AE;--shiki-light-font-style:italic;--shiki-default:#546E7A;--shiki-default-font-style:italic;--shiki-dark:#676E95;--shiki-dark-font-style:italic",[115],{"type":48,"value":116},"        # macOS \u002F Linux\n",{"type":42,"tag":94,"props":118,"children":120},{"class":96,"line":119},2,[121,126,131],{"type":42,"tag":94,"props":122,"children":123},{"style":101},[124],{"type":48,"value":125},"python",{"type":42,"tag":94,"props":127,"children":128},{"style":107},[129],{"type":48,"value":130},"  scripts\u002Fcheck_role.py",{"type":42,"tag":94,"props":132,"children":133},{"style":113},[134],{"type":48,"value":135},"        # Windows (PowerShell \u002F cmd)\n",{"type":42,"tag":51,"props":137,"children":138},{},[139,144,146,152,154,159],{"type":42,"tag":57,"props":140,"children":141},{},[142],{"type":48,"value":143},"Run them from the shell where the AWS CLI already works",{"type":48,"value":145}," — i.e. wherever ",{"type":42,"tag":90,"props":147,"children":149},{"className":148},[],[150],{"type":48,"value":151},"aws sts get-caller-identity",{"type":48,"value":153}," succeeds. The script shells out to that same ",{"type":42,"tag":90,"props":155,"children":157},{"className":156},[],[158],{"type":48,"value":24},{"type":48,"value":160}," binary and inherits the shell's profile, region, SSO session, proxy, and credential chain.",{"type":42,"tag":162,"props":163,"children":164},"blockquote",{},[165],{"type":42,"tag":51,"props":166,"children":167},{},[168,173,175,180,182,186,188,193,195,201,203,209,211,216],{"type":42,"tag":57,"props":169,"children":170},{},[171],{"type":48,"value":172},"Windows \u002F WSL \u002F Git Bash caveat.",{"type":48,"value":174}," Do ",{"type":42,"tag":57,"props":176,"children":177},{},[178],{"type":48,"value":179},"not",{"type":48,"value":181}," invoke these through a Bash shim (WSL, Git Bash, MSYS) on Windows. Those Bash environments frequently do ",{"type":42,"tag":57,"props":183,"children":184},{},[185],{"type":48,"value":179},{"type":48,"value":187}," share the Windows AWS config, credentials, SSO sessions, environment variables, or proxy settings — so ",{"type":42,"tag":90,"props":189,"children":191},{"className":190},[],[192],{"type":48,"value":151},{"type":48,"value":194}," fails inside Bash even when it works natively in PowerShell. (This is exactly why the old ",{"type":42,"tag":90,"props":196,"children":198},{"className":197},[],[199],{"type":48,"value":200},".sh",{"type":48,"value":202}," helpers failed on Windows and were replaced with Python.) If you're in PowerShell, run ",{"type":42,"tag":90,"props":204,"children":206},{"className":205},[],[207],{"type":48,"value":208},"python ...\\check_role.py",{"type":48,"value":210}," directly in PowerShell. If the helper still can't see your identity, run the same discovery natively (see \"Native AWS CLI equivalent\" below) in the shell where ",{"type":42,"tag":90,"props":212,"children":214},{"className":213},[],[215],{"type":48,"value":151},{"type":48,"value":217}," returns your ARN.",{"type":42,"tag":70,"props":219,"children":221},{"id":220},"order-of-operations",[222],{"type":48,"value":223},"Order of operations",{"type":42,"tag":225,"props":226,"children":228},"h3",{"id":227},"step-1-did-the-user-provide-a-role",[229],{"type":48,"value":230},"Step 1 — Did the user provide a role?",{"type":42,"tag":51,"props":232,"children":233},{},[234],{"type":48,"value":235},"Validate that one specifically:",{"type":42,"tag":82,"props":237,"children":239},{"className":84,"code":238,"language":86,"meta":87,"style":87},"python3 scripts\u002Fcheck_role.py \"\u003Crole-name-or-arn>\"\n",[240],{"type":42,"tag":90,"props":241,"children":242},{"__ignoreMap":87},[243],{"type":42,"tag":94,"props":244,"children":245},{"class":96,"line":97},[246,250,254,260,265],{"type":42,"tag":94,"props":247,"children":248},{"style":101},[249],{"type":48,"value":104},{"type":42,"tag":94,"props":251,"children":252},{"style":107},[253],{"type":48,"value":110},{"type":42,"tag":94,"props":255,"children":257},{"style":256},"--shiki-light:#39ADB5;--shiki-default:#89DDFF;--shiki-dark:#89DDFF",[258],{"type":48,"value":259}," \"",{"type":42,"tag":94,"props":261,"children":262},{"style":107},[263],{"type":48,"value":264},"\u003Crole-name-or-arn>",{"type":42,"tag":94,"props":266,"children":267},{"style":256},[268],{"type":48,"value":269},"\"\n",{"type":42,"tag":51,"props":271,"children":272},{},[273],{"type":48,"value":274},"On success it prints the ARN to stdout (exit 0). On failure it logs why on stderr. Don't try to silently fix a broken role — surface the problem.",{"type":42,"tag":225,"props":276,"children":278},{"id":277},"step-2-discover-existing-roles",[279],{"type":48,"value":280},"Step 2 — Discover existing roles",{"type":42,"tag":82,"props":282,"children":284},{"className":84,"code":283,"language":86,"meta":87,"style":87},"python3 scripts\u002Fcheck_role.py\n",[285],{"type":42,"tag":90,"props":286,"children":287},{"__ignoreMap":87},[288],{"type":42,"tag":94,"props":289,"children":290},{"class":96,"line":97},[291,295],{"type":42,"tag":94,"props":292,"children":293},{"style":101},[294],{"type":48,"value":104},{"type":42,"tag":94,"props":296,"children":297},{"style":107},[298],{"type":48,"value":299}," scripts\u002Fcheck_role.py\n",{"type":42,"tag":51,"props":301,"children":302},{},[303,305,311,313,319,321,326],{"type":48,"value":304},"Lists roles matching common SageMaker patterns (",{"type":42,"tag":90,"props":306,"children":308},{"className":307},[],[309],{"type":48,"value":310},"AmazonSageMaker-ExecutionRole-*",{"type":48,"value":312},", ",{"type":42,"tag":90,"props":314,"children":316},{"className":315},[],[317],{"type":48,"value":318},"SageMakerExecutionRole*",{"type":48,"value":320},", etc.), ",{"type":42,"tag":57,"props":322,"children":323},{},[324],{"type":48,"value":325},"ranks by last-used date",{"type":48,"value":327}," (most recent first), validates trust policy in that order, returns the first usable ARN. Most accounts that have used SageMaker before already have one.",{"type":42,"tag":51,"props":329,"children":330},{},[331],{"type":48,"value":332},"Why rank by last-used: in accounts with multiple roles (auto-generated 2021 role + manual project role + etc.), the alphabetically-first one is rarely the actively-maintained one. The most-recently-used role is more likely to have current policies — including cross-account ECR pull. The script prints the ranking so you can see which got picked.",{"type":42,"tag":51,"props":334,"children":335},{},[336,338,343,345,351,353,358],{"type":48,"value":337},"IAM frequently reports ",{"type":42,"tag":57,"props":339,"children":340},{},[341],{"type":48,"value":342},"no",{"type":48,"value":344}," ",{"type":42,"tag":90,"props":346,"children":348},{"className":347},[],[349],{"type":48,"value":350},"RoleLastUsed",{"type":48,"value":352}," at all (tracking only covers recent activity). When every candidate ties at \"never used\", the script falls back to ",{"type":42,"tag":57,"props":354,"children":355},{},[356],{"type":48,"value":357},"newest creation date",{"type":48,"value":359}," — a newer role is more likely to have current policies than a 2021 leftover.",{"type":42,"tag":225,"props":361,"children":363},{"id":362},"step-3-create-only-if-discovery-found-nothing",[364],{"type":48,"value":365},"Step 3 — Create, only if discovery found nothing",{"type":42,"tag":51,"props":367,"children":368},{},[369,374],{"type":42,"tag":57,"props":370,"children":371},{},[372],{"type":48,"value":373},"If the user can create",{"type":48,"value":375}," (has IAM permissions):",{"type":42,"tag":82,"props":377,"children":379},{"className":84,"code":378,"language":86,"meta":87,"style":87},"python3 scripts\u002Fcreate_role.py \"\u003Crole-name>\" \"\u003Cmodel-bucket>\"\n",[380],{"type":42,"tag":90,"props":381,"children":382},{"__ignoreMap":87},[383],{"type":42,"tag":94,"props":384,"children":385},{"class":96,"line":97},[386,390,395,399,404,409,413,418],{"type":42,"tag":94,"props":387,"children":388},{"style":101},[389],{"type":48,"value":104},{"type":42,"tag":94,"props":391,"children":392},{"style":107},[393],{"type":48,"value":394}," scripts\u002Fcreate_role.py",{"type":42,"tag":94,"props":396,"children":397},{"style":256},[398],{"type":48,"value":259},{"type":42,"tag":94,"props":400,"children":401},{"style":107},[402],{"type":48,"value":403},"\u003Crole-name>",{"type":42,"tag":94,"props":405,"children":406},{"style":256},[407],{"type":48,"value":408},"\"",{"type":42,"tag":94,"props":410,"children":411},{"style":256},[412],{"type":48,"value":259},{"type":42,"tag":94,"props":414,"children":415},{"style":107},[416],{"type":48,"value":417},"\u003Cmodel-bucket>",{"type":42,"tag":94,"props":419,"children":420},{"style":256},[421],{"type":48,"value":269},{"type":42,"tag":51,"props":423,"children":424},{},[425],{"type":48,"value":426},"Second arg scopes S3 access to a specific bucket. Omit if unknown; script warns and the user can update the policy later.",{"type":42,"tag":51,"props":428,"children":429},{},[430,435,437,443],{"type":42,"tag":57,"props":431,"children":432},{},[433],{"type":48,"value":434},"If the user cannot create",{"type":48,"value":436}," (SSO principal — ",{"type":42,"tag":90,"props":438,"children":440},{"className":439},[],[441],{"type":48,"value":442},"hf-cloud-aws-context-discovery",{"type":48,"value":444}," will have flagged this):",{"type":42,"tag":51,"props":446,"children":447},{},[448],{"type":48,"value":449},"Stop and surface this clearly. Don't retry alternative IAM operations hoping one works:",{"type":42,"tag":162,"props":451,"children":452},{},[453,458],{"type":42,"tag":51,"props":454,"children":455},{},[456],{"type":48,"value":457},"I can't find an existing SageMaker execution role, and you're authenticated via SSO so you can't create one directly. Please either:",{"type":42,"tag":459,"props":460,"children":461},"ul",{},[462,468],{"type":42,"tag":463,"props":464,"children":465},"li",{},[466],{"type":48,"value":467},"Ask your AWS admin for a SageMaker execution role ARN, or",{"type":42,"tag":463,"props":469,"children":470},{},[471,473,479,480,486,487],{"type":48,"value":472},"Have them grant your SSO permission set ",{"type":42,"tag":90,"props":474,"children":476},{"className":475},[],[477],{"type":48,"value":478},"iam:CreateRole",{"type":48,"value":312},{"type":42,"tag":90,"props":481,"children":483},{"className":482},[],[484],{"type":48,"value":485},"iam:AttachRolePolicy",{"type":48,"value":312},{"type":42,"tag":90,"props":488,"children":490},{"className":489},[],[491],{"type":48,"value":492},"iam:PutRolePolicy",{"type":42,"tag":51,"props":494,"children":495},{},[496],{"type":48,"value":497},"Specific instructions get unblocked fast; vague \"permission denied\" messages don't.",{"type":42,"tag":70,"props":499,"children":501},{"id":500},"what-validated-means",[502],{"type":48,"value":503},"What \"validated\" means",{"type":42,"tag":51,"props":505,"children":506},{},[507,509,515,517,523,525,531],{"type":48,"value":508},"A role is usable when (1) it exists, (2) its trust policy allows ",{"type":42,"tag":90,"props":510,"children":512},{"className":511},[],[513],{"type":48,"value":514},"sagemaker.amazonaws.com",{"type":48,"value":516}," to ",{"type":42,"tag":90,"props":518,"children":520},{"className":519},[],[521],{"type":48,"value":522},"sts:AssumeRole",{"type":48,"value":524}," — see ",{"type":42,"tag":90,"props":526,"children":528},{"className":527},[],[529],{"type":48,"value":530},"references\u002Ftrust-policy.json",{"type":48,"value":532}," for the canonical form.",{"type":42,"tag":51,"props":534,"children":535},{},[536,542,544,548,550,556,558,564],{"type":42,"tag":90,"props":537,"children":539},{"className":538},[],[540],{"type":48,"value":541},"check_role.py",{"type":48,"value":543}," verifies these two. It does ",{"type":42,"tag":57,"props":545,"children":546},{},[547],{"type":48,"value":179},{"type":48,"value":549}," deep-check permissions because comprehensive analysis is expensive (",{"type":42,"tag":90,"props":551,"children":553},{"className":552},[],[554],{"type":48,"value":555},"iam:SimulatePrincipalPolicy",{"type":48,"value":557}," per action) and most existing SageMaker roles are over-permissioned via ",{"type":42,"tag":90,"props":559,"children":561},{"className":560},[],[562],{"type":48,"value":563},"AmazonSageMakerFullAccess",{"type":48,"value":565},". If you suspect a permissions issue at deploy time, the deployment error will tell you which action was denied — fix it then, not preemptively.",{"type":42,"tag":70,"props":567,"children":569},{"id":568},"minimum-permissions",[570],{"type":48,"value":571},"Minimum permissions",{"type":42,"tag":51,"props":573,"children":574},{},[575,581],{"type":42,"tag":90,"props":576,"children":578},{"className":577},[],[579],{"type":48,"value":580},"references\u002Fminimum-permissions.json",{"type":48,"value":582}," covers what SageMaker actually needs:",{"type":42,"tag":459,"props":584,"children":585},{},[586,605,610],{"type":42,"tag":463,"props":587,"children":588},{},[589,595,597,603],{"type":42,"tag":90,"props":590,"children":592},{"className":591},[],[593],{"type":48,"value":594},"s3:GetObject",{"type":48,"value":596}," + ",{"type":42,"tag":90,"props":598,"children":600},{"className":599},[],[601],{"type":48,"value":602},"s3:ListBucket",{"type":48,"value":604}," on the model artifact bucket",{"type":42,"tag":463,"props":606,"children":607},{},[608],{"type":48,"value":609},"ECR pull permissions",{"type":42,"tag":463,"props":611,"children":612},{},[613],{"type":48,"value":614},"CloudWatch logs and metrics",{"type":42,"tag":51,"props":616,"children":617},{},[618,620,625,627,633,635,641,643,648],{"type":48,"value":619},"Layered on top of ",{"type":42,"tag":90,"props":621,"children":623},{"className":622},[],[624],{"type":48,"value":563},{"type":48,"value":626}," (attached by ",{"type":42,"tag":90,"props":628,"children":630},{"className":629},[],[631],{"type":48,"value":632},"create_role.py",{"type":48,"value":634},"). Replace ",{"type":42,"tag":90,"props":636,"children":638},{"className":637},[],[639],{"type":48,"value":640},"REPLACE_WITH_MODEL_BUCKET",{"type":48,"value":642}," in the template with the actual bucket name — ",{"type":42,"tag":90,"props":644,"children":646},{"className":645},[],[647],{"type":48,"value":632},{"type":48,"value":649}," does this automatically when given a bucket as its second argument.",{"type":42,"tag":70,"props":651,"children":653},{"id":652},"native-aws-cli-equivalent-fallback",[654],{"type":48,"value":655},"Native AWS CLI equivalent (fallback)",{"type":42,"tag":51,"props":657,"children":658},{},[659,661,666],{"type":48,"value":660},"If the Python helper can't run or can't see your identity (rare — usually a broken PATH or running under a Bash shim that lacks AWS context), do the same preflight by hand in the shell where ",{"type":42,"tag":90,"props":662,"children":664},{"className":663},[],[665],{"type":48,"value":151},{"type":48,"value":667}," works. The logic is just AWS CLI calls; the helper exists only to bundle and rank them.",{"type":42,"tag":51,"props":669,"children":670},{},[671],{"type":48,"value":672},"PowerShell:",{"type":42,"tag":82,"props":674,"children":678},{"className":675,"code":676,"language":677,"meta":87,"style":87},"language-powershell shiki shiki-themes material-theme-lighter material-theme material-theme-palenight","# 1. List candidate SageMaker roles\naws iam list-roles --query \"Roles[?contains(RoleName,'SageMaker') || contains(RoleName,'sagemaker')]\" --output json\n\n# 2. For each candidate, confirm the trust policy allows sagemaker.amazonaws.com\naws iam get-role --role-name \u003Crole-name> --query \"Role.AssumeRolePolicyDocument\" --output json\n\n# 3. Prefer the most-recently-used role with SageMaker-execution naming\n#    (LastUsedDate is often None for every role — then prefer newest CreateDate)\naws iam get-role --role-name \u003Crole-name> --query \"Role.[RoleLastUsed.LastUsedDate, CreateDate]\" --output text\n","powershell",[679],{"type":42,"tag":90,"props":680,"children":681},{"__ignoreMap":87},[682,690,698,708,717,726,734,743,752],{"type":42,"tag":94,"props":683,"children":684},{"class":96,"line":97},[685],{"type":42,"tag":94,"props":686,"children":687},{},[688],{"type":48,"value":689},"# 1. List candidate SageMaker roles\n",{"type":42,"tag":94,"props":691,"children":692},{"class":96,"line":119},[693],{"type":42,"tag":94,"props":694,"children":695},{},[696],{"type":48,"value":697},"aws iam list-roles --query \"Roles[?contains(RoleName,'SageMaker') || contains(RoleName,'sagemaker')]\" --output json\n",{"type":42,"tag":94,"props":699,"children":701},{"class":96,"line":700},3,[702],{"type":42,"tag":94,"props":703,"children":705},{"emptyLinePlaceholder":704},true,[706],{"type":48,"value":707},"\n",{"type":42,"tag":94,"props":709,"children":711},{"class":96,"line":710},4,[712],{"type":42,"tag":94,"props":713,"children":714},{},[715],{"type":48,"value":716},"# 2. For each candidate, confirm the trust policy allows sagemaker.amazonaws.com\n",{"type":42,"tag":94,"props":718,"children":720},{"class":96,"line":719},5,[721],{"type":42,"tag":94,"props":722,"children":723},{},[724],{"type":48,"value":725},"aws iam get-role --role-name \u003Crole-name> --query \"Role.AssumeRolePolicyDocument\" --output json\n",{"type":42,"tag":94,"props":727,"children":729},{"class":96,"line":728},6,[730],{"type":42,"tag":94,"props":731,"children":732},{"emptyLinePlaceholder":704},[733],{"type":48,"value":707},{"type":42,"tag":94,"props":735,"children":737},{"class":96,"line":736},7,[738],{"type":42,"tag":94,"props":739,"children":740},{},[741],{"type":48,"value":742},"# 3. Prefer the most-recently-used role with SageMaker-execution naming\n",{"type":42,"tag":94,"props":744,"children":746},{"class":96,"line":745},8,[747],{"type":42,"tag":94,"props":748,"children":749},{},[750],{"type":48,"value":751},"#    (LastUsedDate is often None for every role — then prefer newest CreateDate)\n",{"type":42,"tag":94,"props":753,"children":755},{"class":96,"line":754},9,[756],{"type":42,"tag":94,"props":757,"children":758},{},[759],{"type":48,"value":760},"aws iam get-role --role-name \u003Crole-name> --query \"Role.[RoleLastUsed.LastUsedDate, CreateDate]\" --output text\n",{"type":42,"tag":51,"props":762,"children":763},{},[764,766,771,773,778],{"type":48,"value":765},"Pick the most-recently-used role whose trust policy contains ",{"type":42,"tag":90,"props":767,"children":769},{"className":768},[],[770],{"type":48,"value":514},{"type":48,"value":772},". Use the resulting ARN exactly as if ",{"type":42,"tag":90,"props":774,"children":776},{"className":775},[],[777],{"type":48,"value":541},{"type":48,"value":779}," had returned it. Bash\u002FmacOS\u002FLinux use the same commands.",{"type":42,"tag":781,"props":782,"children":783},"style",{},[784],{"type":48,"value":785},"html .light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html.light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html .default .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}html.dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}",{"items":787,"total":875},[788,806,817,831,844,851,865],{"slug":789,"name":789,"fn":790,"description":791,"org":792,"tags":793,"stars":25,"repoUrl":26,"updatedAt":805},"hf-cli","manage Hugging Face Hub resources via CLI","Hugging Face Hub CLI (`hf`) for downloading, uploading, and managing models, datasets, spaces, buckets, repos, papers, jobs, and more on the Hugging Face Hub. Use when: handling authentication; managing local cache; managing Hugging Face Buckets; running or scheduling jobs on Hugging Face infrastructure; managing Hugging Face repos; discussions and pull requests; browsing models, datasets and spaces; reading, searching, or browsing academic papers; managing collections; querying datasets; configuring spaces; setting up webhooks; or deploying and managing HF Inference Endpoints. Make sure to use this skill whenever the user mentions 'hf', 'huggingface', 'Hugging Face', 'huggingface-cli', or 'hugging face cli', or wants to do anything related to the Hugging Face ecosystem and to AI and ML in general. Also use for cloud storage needs like training checkpoints, data pipelines, or agent traces. Use even if the user doesn't explicitly ask for a CLI command. Replaces the deprecated `huggingface-cli`.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[794,797,800,802],{"name":795,"slug":796,"type":15},"CLI","cli",{"name":798,"slug":799,"type":15},"Datasets","datasets",{"name":9,"slug":801,"type":15},"hugging-face",{"name":803,"slug":804,"type":15},"LLM","llm","2026-04-06T18:25:34.020855",{"slug":442,"name":442,"fn":807,"description":808,"org":809,"tags":810,"stars":25,"repoUrl":26,"updatedAt":816},"discover local AWS environment context","Discover the user's local AWS context (active profile, region, account ID, caller identity) at the start of any AWS task. Use this skill before any other AWS work — deploying to SageMaker, creating resources, calling AWS APIs, or anything that touches an AWS account. Use it especially when the user has not specified a region or profile explicitly, when they say things like \"use my AWS account\", \"deploy to AWS\", \"use my profile\", or when about to make any AWS CLI or SDK call. Never guess the region or account ID — always use this skill to read it from the local configuration first.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[811,812,813],{"name":23,"slug":24,"type":15},{"name":795,"slug":796,"type":15},{"name":814,"slug":815,"type":15},"Configuration","configuration","2026-07-08T05:55:33.716099",{"slug":818,"name":818,"fn":819,"description":820,"org":821,"tags":822,"stars":25,"repoUrl":26,"updatedAt":830},"hf-cloud-python-env-setup","set up Python environments for AWS","Set up an isolated Python environment for SageMaker \u002F AWS work, with the right Python version and current boto3. Use this skill whenever Python code will be executed for a SageMaker deployment, training job, or any AWS automation — including when about to run `pip install`, when about to invoke `boto3`, when creating or activating a virtualenv, or when the user asks to \"set up the environment\". Never use system Python and never `pip install` into it. Always isolate. This skill prevents the most common failure modes: wrong Python version, dependency conflicts, and stale SDKs.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[823,824,825,828],{"name":20,"slug":21,"type":15},{"name":23,"slug":24,"type":15},{"name":826,"slug":827,"type":15},"Engineering","engineering",{"name":829,"slug":125,"type":15},"Python","2026-07-08T05:55:32.505017",{"slug":832,"name":832,"fn":833,"description":834,"org":835,"tags":836,"stars":25,"repoUrl":26,"updatedAt":843},"hf-cloud-sagemaker-deployment-planner","plan model deployments to Amazon SageMaker","Plan and coordinate the deployment of a model to Amazon SageMaker AI. Use this skill whenever the user wants to deploy, host, serve, or expose a model on SageMaker or AWS — including phrases like \"deploy a model\", \"host this LLM on AWS\", \"serve this embedding model\", \"deploy a reranker\", \"deploy a text-to-image \u002F diffusion model\", \"host this for async inference\", \"create an endpoint\", \"serve my fine-tuned model\", or any request that involves making a model available for inference on AWS. Use this even when the user is vague (e.g. \"I just want to get this running on AWS, you figure it out\"). Works for text-generation LLMs, embedding models, rerankers, classifiers, text-to-image \u002F diffusion models — picks the right serving stack and chooses between real-time and async inference. This is the entry-point skill for SageMaker deployment work — it asks clarifying questions, picks a deployment pathway, and coordinates the other deployment skills.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[837,838,839,842],{"name":20,"slug":21,"type":15},{"name":23,"slug":24,"type":15},{"name":840,"slug":841,"type":15},"Deployment","deployment",{"name":9,"slug":801,"type":15},"2026-07-08T05:55:37.387689",{"slug":4,"name":4,"fn":5,"description":6,"org":845,"tags":846,"stars":25,"repoUrl":26,"updatedAt":27},{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[847,848,849,850],{"name":20,"slug":21,"type":15},{"name":23,"slug":24,"type":15},{"name":17,"slug":18,"type":15},{"name":13,"slug":14,"type":15},{"slug":852,"name":852,"fn":853,"description":854,"org":855,"tags":856,"stars":25,"repoUrl":26,"updatedAt":864},"hf-cloud-sagemaker-production-defaults","create production-ready SageMaker endpoints","Create a SageMaker endpoint (real-time or async) with autoscaling, CloudWatch alarms, and tagging enabled by default. Use this skill whenever about to create a SageMaker endpoint, write deployment code that calls `create_endpoint`, or finalize a deployment after the image URI and IAM role are known. Provides deploy.py for real-time endpoints and deploy_async.py for async endpoints (with genuine scale-to-zero support). This is the last step in the SageMaker deployment workflow. Never generate a bare `create_endpoint` call without these defaults — endpoints without autoscaling or alarms are demos, not deployments.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[857,858,859,860,861],{"name":20,"slug":21,"type":15},{"name":23,"slug":24,"type":15},{"name":840,"slug":841,"type":15},{"name":9,"slug":801,"type":15},{"name":862,"slug":863,"type":15},"Monitoring","monitoring","2026-07-08T05:55:38.664702",{"slug":866,"name":866,"fn":867,"description":868,"org":869,"tags":870,"stars":25,"repoUrl":26,"updatedAt":874},"hf-cloud-serving-image-selection","select SageMaker serving containers","Pick the right serving container for a SageMaker model deployment and find its current image URI. Use this skill whenever about to deploy a model to a SageMaker endpoint and an image URI needs to be chosen — including when the user says \"deploy this LLM\", \"host this HuggingFace model\", \"serve this fine-tuned model\", \"deploy this embedding model\", \"host a reranker\", \"serve a sentence-transformers model\", or when about to hardcode any container URI in deployment code. HuggingFace-curated Deep Learning Containers are ALWAYS preferred: HuggingFace vLLM (LLMs and generative rerankers), HuggingFace vLLM-Omni (multimodal), TEI (embeddings\u002Fcross-encoder rerankers), HF Inference Toolkit (other transformers). Generic images (AWS vLLM, DJL-LMI, SGLang) are used only when no HuggingFace image is compatible — never merely because they carry a newer version. Never hardcode a container URI from memory and never default to TGI. Prevents stale-image failures and wrong-region URIs.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[871,872,873],{"name":20,"slug":21,"type":15},{"name":23,"slug":24,"type":15},{"name":840,"slug":841,"type":15},"2026-07-08T05:55:36.173465",24,{"items":877,"total":1000},[878,896,910,917,923,930,937,944,952,958,971,985],{"slug":879,"name":879,"fn":880,"description":881,"org":882,"tags":883,"stars":893,"repoUrl":894,"updatedAt":895},"train-sentence-transformers","train sentence-transformers models","Train or fine-tune sentence-transformers models across `SentenceTransformer` (bi-encoder; dense or static embedding model; for retrieval, similarity, clustering, classification, paraphrase mining, dedup, multimodal), `CrossEncoder` (reranker; pair scoring for two-stage retrieval \u002F pair classification), and `SparseEncoder` (SPLADE, sparse embedding model; for learned-sparse retrieval). Covers loss selection, hard-negative mining, evaluators, distillation, LoRA, Matryoshka, and Hugging Face Hub publishing. Use for any sentence-transformers training task.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[884,887,888,889,890],{"name":885,"slug":886,"type":15},"Deep Learning","deep-learning",{"name":9,"slug":801,"type":15},{"name":803,"slug":804,"type":15},{"name":829,"slug":125,"type":15},{"name":891,"slug":892,"type":15},"Search","search",18914,"https:\u002F\u002Fgithub.com\u002Fhuggingface\u002Fsentence-transformers","2026-05-08T05:09:16.820066",{"slug":897,"name":897,"fn":898,"description":899,"org":900,"tags":901,"stars":907,"repoUrl":908,"updatedAt":909},"trl-training","train and fine-tune LLMs with TRL","Train and fine-tune transformer language models using TRL (Transformers Reinforcement Learning). Supports SFT, DPO, GRPO, KTO, RLOO and Reward Model training via CLI commands.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[902,903,904,905,906],{"name":20,"slug":21,"type":15},{"name":885,"slug":886,"type":15},{"name":9,"slug":801,"type":15},{"name":803,"slug":804,"type":15},{"name":829,"slug":125,"type":15},18850,"https:\u002F\u002Fgithub.com\u002Fhuggingface\u002Ftrl","2026-04-06T18:25:32.746828",{"slug":789,"name":789,"fn":790,"description":791,"org":911,"tags":912,"stars":25,"repoUrl":26,"updatedAt":805},{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[913,914,915,916],{"name":795,"slug":796,"type":15},{"name":798,"slug":799,"type":15},{"name":9,"slug":801,"type":15},{"name":803,"slug":804,"type":15},{"slug":442,"name":442,"fn":807,"description":808,"org":918,"tags":919,"stars":25,"repoUrl":26,"updatedAt":816},{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[920,921,922],{"name":23,"slug":24,"type":15},{"name":795,"slug":796,"type":15},{"name":814,"slug":815,"type":15},{"slug":818,"name":818,"fn":819,"description":820,"org":924,"tags":925,"stars":25,"repoUrl":26,"updatedAt":830},{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[926,927,928,929],{"name":20,"slug":21,"type":15},{"name":23,"slug":24,"type":15},{"name":826,"slug":827,"type":15},{"name":829,"slug":125,"type":15},{"slug":832,"name":832,"fn":833,"description":834,"org":931,"tags":932,"stars":25,"repoUrl":26,"updatedAt":843},{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[933,934,935,936],{"name":20,"slug":21,"type":15},{"name":23,"slug":24,"type":15},{"name":840,"slug":841,"type":15},{"name":9,"slug":801,"type":15},{"slug":4,"name":4,"fn":5,"description":6,"org":938,"tags":939,"stars":25,"repoUrl":26,"updatedAt":27},{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[940,941,942,943],{"name":20,"slug":21,"type":15},{"name":23,"slug":24,"type":15},{"name":17,"slug":18,"type":15},{"name":13,"slug":14,"type":15},{"slug":852,"name":852,"fn":853,"description":854,"org":945,"tags":946,"stars":25,"repoUrl":26,"updatedAt":864},{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[947,948,949,950,951],{"name":20,"slug":21,"type":15},{"name":23,"slug":24,"type":15},{"name":840,"slug":841,"type":15},{"name":9,"slug":801,"type":15},{"name":862,"slug":863,"type":15},{"slug":866,"name":866,"fn":867,"description":868,"org":953,"tags":954,"stars":25,"repoUrl":26,"updatedAt":874},{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[955,956,957],{"name":20,"slug":21,"type":15},{"name":23,"slug":24,"type":15},{"name":840,"slug":841,"type":15},{"slug":959,"name":959,"fn":960,"description":961,"org":962,"tags":963,"stars":25,"repoUrl":26,"updatedAt":970},"hf-mcp","access Hugging Face Hub via MCP","Use Hugging Face Hub via MCP server tools. Search models, datasets, Spaces, papers. Get repo details, fetch documentation, run compute jobs, and use Gradio Spaces as AI tools. Available when connected to the HF MCP server.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[964,965,966,967],{"name":798,"slug":799,"type":15},{"name":9,"slug":801,"type":15},{"name":803,"slug":804,"type":15},{"name":968,"slug":969,"type":15},"MCP","mcp","2026-04-06T18:25:50.364185",{"slug":972,"name":972,"fn":973,"description":974,"org":975,"tags":976,"stars":25,"repoUrl":26,"updatedAt":984},"hf-mem","estimate memory for Hugging Face models","Hugging Face CLI to estimate the required memory to load Safetensors or GGUF model weights for inference from the Hugging Face Hub",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[977,978,979,980,981],{"name":20,"slug":21,"type":15},{"name":795,"slug":796,"type":15},{"name":9,"slug":801,"type":15},{"name":803,"slug":804,"type":15},{"name":982,"slug":983,"type":15},"Performance","performance","2026-06-13T07:23:57.101435",{"slug":986,"name":986,"fn":987,"description":988,"org":989,"tags":990,"stars":25,"repoUrl":26,"updatedAt":999},"huggingface-best","find and compare Hugging Face models","Use when the user asks about finding the best, top, or recommended model for a task, wants to know what AI model to use, or wants to compare models by benchmark scores. Triggers on: \"best model for X\", \"what model should I use for\", \"top models for [task]\", \"which model runs on my laptop\u002Fmachine\u002Fdevice\", \"recommend a model for\", \"what LLM should I use for\", \"compare models for\", \"what's state of the art for\", or any question about choosing an AI model for a specific use case. Always use this skill when the user wants model recommendations or comparisons, even if they don't explicitly mention HuggingFace or benchmarks.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[991,994,995,996],{"name":992,"slug":993,"type":15},"Analytics","analytics",{"name":9,"slug":801,"type":15},{"name":803,"slug":804,"type":15},{"name":997,"slug":998,"type":15},"Research","research","2026-04-24T05:09:45.870658",37]