Amazon SageMaker

Amazon SageMaker is the AWS managed machine learning platform. Polysync integrates with SageMaker Pipelines (the SageMaker Model Building Pipelines / SDK v2 workflow service) using the official AWS SDK for .NET v4 (AWSSDK.SageMaker and AWSSDK.SecurityToken). Polysync can list pipelines, start executions with declared parameters, poll execution status, cancel running executions, and surface a direct link to the SageMaker Studio / classic console for monitoring.

Required attributes

• Region — the AWS region in which the SageMaker domain and pipelines are deployed (e.g., us-east-1, eu-west-1). All SageMaker API calls are region-scoped.

Optional platform-level defaults

• Pipeline Execution Role ARN — a default execution role ARN passed when the per-job override is not set. Most pipelines specify their own role at creation time, in which case this can be left blank.

Authentication methods

• Web Identity Federation ⭐ (recommended for Polysync SaaS) — Polysync exchanges its Microsoft Entra ID workload identity token for short-lived AWS credentials via sts:AssumeRoleWithWebIdentity. No long-lived secrets stored. Required attributes: Role ARN.
  • In AWS, create an IAM Identity Provider (OIDC) trusting Polysync's Entra ID issuer (https://login.microsoftonline.com/<polysync-tenant-id>/v2.0) with audience sts.amazonaws.com.
  • Create an IAM role whose trust policy allows sts:AssumeRoleWithWebIdentity from that provider with a condition on the Polysync workload identity's sub / oid claim.
• Access Key — Provide Access Key Id, Secret Access Key, and optionally Session Token. Simplest, but the secret must be rotated and stored in a Secret Vault.
• Assume Role — Provide a bootstrap Access Key Id and Secret Access Key, plus the Role ARN to assume. The bootstrap user only needs sts:AssumeRole on the target role; the assumed role holds the SageMaker permissions.
• Instance Profile — Uses the host EC2/ECS instance profile. Only viable when Polysync is deployed inside AWS.

IAM permissions checklist

The role / user used by Polysync needs (at minimum):

• sagemaker:ListPipelines — discover available pipelines.
• sagemaker:DescribePipeline — read pipeline metadata, ARN, and pipeline role.
• sagemaker:StartPipelineExecution — start executions (scope to specific pipeline ARNs in production).
• sagemaker:DescribePipelineExecution — poll execution status.
• sagemaker:StopPipelineExecution — cancel running executions.
• iam:PassRole (on the pipeline execution role) — only required when supplying an execution role at start time.

The pipeline's own execution role needs whatever permissions its steps require (S3, ECR, CloudWatch Logs, Model Registry, etc.) — these are defined on the role attached to the pipeline, not on the Polysync caller.

Supported jobs

• SageMaker Pipeline — starts a SageMaker Pipeline execution.

Scope notes

This initial provider integrates SageMaker Pipelines only — the most natural fit for Polysync's pipeline-orchestration model. Other SageMaker resources (training jobs, processing jobs, transform jobs, hyperparameter tuning jobs, real-time endpoints) are not yet exposed as Polysync Job types. They can be invoked indirectly by wrapping them in a SageMaker Pipeline step (TrainingStep, ProcessingStep, TransformStep, TuningStep, LambdaStep), which is the AWS-recommended pattern for orchestrated ML workflows.

Troubleshooting

• Web Identity Federation InvalidIdentityToken — check that the IAM Identity Provider's thumbprint matches login.microsoftonline.com, the audience is sts.amazonaws.com, and the role trust policy allows the Polysync workload identity's sub / oid.
• AccessDeniedException on listing pipelines — the caller is missing sagemaker:ListPipelines in the target region.