aws-stepfunctions-tasks: endpointConfigName Token not resolved in create endpoint task
- Dominant language
- TypeScript
- Stars
- 12.9k
- Forks
- 4.6k
- Avg merge
- 2d 3h
- Merged PRs (30d)
- 83
Description
### Describe the bug
CDK doesn't resolve endpoint configuration name in create endpoint task when endpointConfigName is coming from another CDK resource.
Looks like that toLowerCase is causing the trouble.
https://github.com/aws/aws-cdk/blob/v1.178.0/packages/@aws-cdk/aws-stepfunctions-tasks/lib/sagemaker/create-endpoint.ts#L86
### Expected Behavior
```
{
"Version": "2012-10-17",
"Statement": [
{
"Action": "sagemaker:createEndpoint",
"Resource": [
"arn:aws:sagemaker:us-east-1:1234567890:endpoint-config/sagemakerendpointconfig-s39vugh0gkoj",
"arn:aws:sagemaker:us-east-1:1234567890:endpoint/endpoint"
],
"Effect": "Allow"
},
{
"Action": "sagemaker:ListTags",
"Resource": "*",
"Effect": "Allow"
}
]
}
```
### Current Behavior
```
{
"Version": "2012-10-17",
"Statement": [
{
"Action": "sagemaker:createEndpoint",
"Resource": [
"arn:aws:sagemaker:us-east-1:1234567890:endpoint-config/${token[token.264]}",
"arn:aws:sagemaker:us-east-1:1234567890:endpoint/endpoint"
],
"Effect": "Allow"
},
{
"Action": "sagemaker:ListTags",
"Resource": "*",
"Effect": "Allow"
}
]
}
```
### Reproduction Steps
1. Define endpointcofig and step function:
```
const sagemakerEndpointConfig = new sagemaker.CfnEndpointConfig(this, 'sagemakerEndpointConfig', {
productionVariants: [{
initialVariantWeight: 1,
modelName: model.attrModelName,
variantName: 'default',
initialInstanceCount: 1,
instanceType: 'ml.c4.4xlarge',
}],
});
const taskCreateEndpoint = new tasks.SageMakerCreateEndpoint(this, 'taskCreateEndpoint', {
endpointName: 'endpointblabla',
endpointConfigName: sagemakerEndpointConfig.attrEndpointConfigName,
});
const stateMachine = new sfn.StateMachine(this, 'stateMachine', {
definition: taskCreateEndpoint,
});
```
2. Invoke the state machine
3. Exception from invocation:
```
User: arn:aws:sts::1234567890:assumed-role/xxx-stateMachineRoleD7DCE394-LS2JK2THJEVN/XSPwMkuMxIVkbakcsGDVCSPhcLwtfitA is not authorized to perform: sagemaker:CreateEndpoint on resource: arn:aws:sagemaker:us-east-1:1234567890:endpoint-config/sagemakerendpointconfig-s39vugh0gkoj because no identity-based policy allows the sagemaker:CreateEndpoint action (Service: AmazonSageMaker; Status Code: 400; Error Code: AccessDeniedException; Request ID: 558f50e2-42bb-4a29-8397-001fe1a38d96; Proxy: null)
```
### Possible Solution
_No response_
### Additional Information/Context
_No response_
### CDK CLI Version
2.47.0 (build 3528e3d)
### Framework Version
_No response_
### Node.js Version
v18.11.0
### OS
mac
### Language
Typescript
### Language Version
_No response_
### Other information
_No response_
Contributor guide
Assessment
This issue has not been assessed yet.