Fix CI setup

[tkilias]

• This project uses AWS CI isolation to run its integration tests with SageMaker
• However, SageMaker needs a role with specific permission (SageMakerFullAcess and S3FullAccess)
• In general, we could create this role in the CDK description once and make it protected, such that it doesn't get cleaned up
• The issues with this is, that a CI user isn't allowed to pass or assume a protected role by the CI isolation master setup
  • https://github.com/exasol/ci-isolation-aws/blob/977ea37602b1efd56ae376e8846555d49fa8fc9c/src/main/java/com/exasol/ciisolation/aws/cleanup/AccountCleanupStack.java#L87
  • https://github.com/exasol/ci-isolation-aws/blob/977ea37602b1efd56ae376e8846555d49fa8fc9c/src/main/java/com/exasol/ciisolation/aws/cleanup/AccountCleanupStack.java#L94
  • Solutions
  • Introduce a role which is not removed, but allowed to assume and passed
  • Create the Role during running the tests
• Needed role and polices

  
  aws iam create-role --role-name sagemaker-role --assume-role-policy-document '{
              "Version": "2012-10-17",
              "Statement": [
                  {
                      "Effect": "Allow",
                      "Principal": {
                          "Service": "sagemaker.amazonaws.com"
                      },
                      "Action": "sts:AssumeRole"
                  }
              ]
          }'

aws iam create-policy --policy-name "sagemaker-s3-access" --policy-document '{ "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "s3:" ], "Resource": "" }, { "Effect": "Allow", "Action": [ "iam:CreatePolicy", "iam:CreateRole", "iam:AttachRolePolicy", "iam:DeleteRole", "iam:DeletePolicy", "iam:DetachRolePolicy" ], "Resource": "*" } ] }'

aws iam attach-role-policy --role-name sagemaker-role --policy-arn arn:aws:iam::166283903643:policy/sagemaker-s3-access aws iam attach-role-policy --role-name sagemaker-role --policy-arn arn:aws:iam::aws:policy/AmazonSageMakerFullAccess

[tkilias]

Time needed for analysis of the issue: 3d