From e49c02757d156ddbbcb6fc3c636a29a084fe48b3 Mon Sep 17 00:00:00 2001 From: Roja Reddy Sareddy Date: Fri, 7 Aug 2026 22:22:22 -0700 Subject: [PATCH 1/2] Fix tests in trainers --- sagemaker-train/tests/unit/train/test_dpo_trainer.py | 2 +- sagemaker-train/tests/unit/train/test_rlvr_trainer.py | 2 +- sagemaker-train/tests/unit/train/test_sft_trainer.py | 2 +- 3 files changed, 3 insertions(+), 3 deletions(-) diff --git a/sagemaker-train/tests/unit/train/test_dpo_trainer.py b/sagemaker-train/tests/unit/train/test_dpo_trainer.py index 46c181e3ab..5dfae85bfd 100644 --- a/sagemaker-train/tests/unit/train/test_dpo_trainer.py +++ b/sagemaker-train/tests/unit/train/test_dpo_trainer.py @@ -549,7 +549,7 @@ def test_train_passes_sequence_length_to_serverless_config(self, mock_training_j mock_get_role, mock_get_options, mock_resolve_model): mock_validate_group.return_value = "test-group" mock_resolve_model.return_value = ("test-model", "test-model") - mock_get_sagemaker_session.return_value = Mock() + mock_get_sagemaker_session.return_value = Mock(sagemaker_config={}) mock_fine_tuning_options = Mock() mock_fine_tuning_options.to_dict.return_value = {} mock_get_options.return_value = (mock_fine_tuning_options, "model-arn", False) diff --git a/sagemaker-train/tests/unit/train/test_rlvr_trainer.py b/sagemaker-train/tests/unit/train/test_rlvr_trainer.py index a273e5a470..3929b3cfa5 100644 --- a/sagemaker-train/tests/unit/train/test_rlvr_trainer.py +++ b/sagemaker-train/tests/unit/train/test_rlvr_trainer.py @@ -552,7 +552,7 @@ def test_train_passes_sequence_length_to_serverless_config(self, mock_training_j mock_get_role, mock_get_options, mock_resolve_model): mock_validate_group.return_value = "test-group" mock_resolve_model.return_value = ("test-model", "test-model") - mock_get_sagemaker_session.return_value = Mock() + mock_get_sagemaker_session.return_value = Mock(sagemaker_config={}) mock_fine_tuning_options = Mock() mock_fine_tuning_options.to_dict.return_value = {} mock_get_options.return_value = (mock_fine_tuning_options, "model-arn", False) diff --git a/sagemaker-train/tests/unit/train/test_sft_trainer.py b/sagemaker-train/tests/unit/train/test_sft_trainer.py index 8bffa025de..00996c7858 100644 --- a/sagemaker-train/tests/unit/train/test_sft_trainer.py +++ b/sagemaker-train/tests/unit/train/test_sft_trainer.py @@ -563,7 +563,7 @@ def test_train_passes_sequence_length_to_serverless_config(self, mock_training_j mock_get_role, mock_get_options, mock_resolve_model): mock_validate_group.return_value = "test-group" mock_resolve_model.return_value = ("test-model", "test-model") - mock_get_sagemaker_session.return_value = Mock() + mock_get_sagemaker_session.return_value = Mock(sagemaker_config={}) mock_fine_tuning_options = Mock() mock_fine_tuning_options.to_dict.return_value = {} mock_get_options.return_value = (mock_fine_tuning_options, "model-arn", False) From 4e609d193d4b6c01e6b11230b7b06a195f913542 Mon Sep 17 00:00:00 2001 From: Roja Reddy Sareddy Date: Sat, 8 Aug 2026 18:56:13 -0700 Subject: [PATCH 2/2] fix(iam): Remove iam:PassRole from caller validation to avoid false denials SimulatePrincipalPolicy without iam:PassedToService context value returns implicitDeny for condition-scoped PassRole policies like AmazonSageMakerFullAccess, causing false test failures. --- sagemaker-core/src/sagemaker/core/helper/iam_policies.py | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/sagemaker-core/src/sagemaker/core/helper/iam_policies.py b/sagemaker-core/src/sagemaker/core/helper/iam_policies.py index 5878ac883c..2613418ea8 100644 --- a/sagemaker-core/src/sagemaker/core/helper/iam_policies.py +++ b/sagemaker-core/src/sagemaker/core/helper/iam_policies.py @@ -831,7 +831,10 @@ "sagemaker:ListTags", "sagemaker:AddTags", "sagemaker:DescribeTrainingJob", - "iam:PassRole", + # NOTE: iam:PassRole is intentionally excluded. The AmazonSageMakerFullAccess + # policy conditions it on iam:PassedToService=sagemaker.amazonaws.com, and + # SimulatePrincipalPolicy without that context value returns implicitDeny — + # a false positive that blocks callers who actually have the permission. # Model resolution (DescribeHubContent called at construction time under caller creds) "sagemaker:DescribeHubContent", "sagemaker:ListHubContents",