fix: fix broken permissions for sagemaker studio role (#441)

Author: jiahuii-amazon

CHANGELOG.md

@@ -11,6 +11,8 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ### **Changed**
 
+- fixed `sagemaker-studio` role broken describe image version permissions
+
 ## v3.2.5
 
 ### **Added**

modules/sagemaker/sagemaker-studio/helper_constructs/sm_roles.py

@@ -316,10 +316,12 @@ def __init__(
                                 "sagemaker:DescribeImage",
                                 "sagemaker:DescribeImageVersion",
                                 "sagemaker:ListImageVersions",
+                                "sagemaker:DescribeAppImageConfig",
                             ],
                             resources=[
-                                f"arn:{Aws.PARTITION}:sagemaker:{Aws.REGION}:{Aws.ACCOUNT_ID}:image/*"
-                                f"arn:{Aws.PARTITION}:sagemaker:{Aws.REGION}:{Aws.ACCOUNT_ID}:image-version/*/*"
+                                f"arn:{Aws.PARTITION}:sagemaker:{Aws.REGION}:{Aws.ACCOUNT_ID}:image/*",
+                                f"arn:{Aws.PARTITION}:sagemaker:{Aws.REGION}:{Aws.ACCOUNT_ID}:image-version/*/*",
+                                f"arn:{Aws.PARTITION}:sagemaker:{Aws.REGION}:{Aws.ACCOUNT_ID}:app-image-config/*",
                             ],
                         )
                     ]

modules/sagemaker/sagemaker-studio/stack.py

@@ -303,6 +303,9 @@ def enable_domain_resource_isolation(self, roles: List[iam.Role]) -> None:
                         f"arn:{core.Aws.PARTITION}:sagemaker:{core.Aws.REGION}:{core.Aws.ACCOUNT_ID}:project/*",
                         f"arn:{core.Aws.PARTITION}:sagemaker:{core.Aws.REGION}:{core.Aws.ACCOUNT_ID}:app/*",
                         f"arn:{core.Aws.PARTITION}:sagemaker:{core.Aws.REGION}:{core.Aws.ACCOUNT_ID}:space/*",
+                        f"arn:{core.Aws.PARTITION}:sagemaker:{core.Aws.REGION}:{core.Aws.ACCOUNT_ID}:image/*",
+                        f"arn:{core.Aws.PARTITION}:sagemaker:{core.Aws.REGION}:{core.Aws.ACCOUNT_ID}:image-version/*/*",
+                        f"arn:{core.Aws.PARTITION}:sagemaker:{core.Aws.REGION}:{core.Aws.ACCOUNT_ID}:app-image-config/*",
                     ],
                     conditions={
                         "StringNotEquals": {