github-actions-setup.yml

AWSTemplateFormatVersion: "2010-09-09"
Description: Setup IAM user for GitHub Actions and IAM role for SageMaker

Parameters:
  GitHubActionsUserName:
    Type: String
    Default: github-actions-sagemaker-user
  SageMakerRoleName:
    Type: String
    Default: github-actions-sagemaker-role

Resources:
  GitHubActionsUser:
    Type: AWS::IAM::User
    Properties:
      UserName: !Ref GitHubActionsUserName

  GitHubActionsUserAccessKey:
    Type: AWS::IAM::AccessKey
    Properties:
      UserName: !Ref GitHubActionsUser
      Serial: 1

  GitHubActionsCredentials:
    Type: AWS::SecretsManager::Secret
    Properties:
      Name: !Ref GitHubActionsUserName
      SecretString: !Sub |
        {
          "AccessKeyId":"${GitHubActionsUserAccessKey}",
          "SecretAccessKey":"${GitHubActionsUserAccessKey.SecretAccessKey}"
        }

  # Permissions to perform cloudformation and assume pass SageMakerRole for autoscaling
  GitHubActionsDeployPolicy:
    Type: AWS::IAM::Policy
    Properties:
      Roles:
        - !Ref SageMakerRole
      PolicyName: allow-github-actions-cloudformation-deploy
      PolicyDocument:
        Version: "2012-10-17"
        Statement:
          - Action:
              - "cloudformation:*"
            Effect: Allow
            Resource: "*"
          - Action: "cloudformation:DeleteStack"
            Effect: Deny
            Resource: "*"
          - Action: "iam:PassRole"
            Effect: Allow
            Resource: !GetAtt SageMakerRole.Arn

  SageMakerRole:
    Type: AWS::IAM::Role
    Properties:
      RoleName: !Ref SageMakerRoleName
      MaxSessionDuration: 43200 # 12 hours maximum duration
      AssumeRolePolicyDocument:
        Version: "2012-10-17"
        Statement:
          - Effect: "Allow"
            Principal:
              Service:
                - sagemaker.amazonaws.com
            Action:
              - "sts:AssumeRole"
          - Effect: "Allow"
            Principal:
              AWS: !GetAtt GitHubActionsUser.Arn
            Action:
              - "sts:AssumeRole"
              - "sts:TagSession"
      ManagedPolicyArns:
        - arn:aws:iam::aws:policy/AmazonS3FullAccess
        - arn:aws:iam::aws:policy/AmazonSageMakerFullAccess

Outputs:
  SageMakerRoleArn:
    Value: !GetAtt SageMakerRole.Arn