The CodePipeline and CodeBuild role can iam:PassRole to any role and sagemaker:* in every account. What should they do?
Select an answer to reveal the explanation.
Short Explanation
The pipeline role can PassRole to any role and sagemaker:* in every account. Narrow it to the deploy actions and the specific SageMaker roles it may pass. AdministratorAccess or unrestricted PassRole is the opposite of pipeline least privilege.
Full Explanation
A CI/CD service role should allow only the deploy actions and the SageMaker roles it must pass, not sagemaker:* and PassRole to any role. Lex is not that role. AdministratorAccess or unrestricted PassRole is the opposite of pipeline least privilege.