fix: grant S3 permissions to Role instead of ManagedPolicy (#396)

The grant_read_write() method was incorrectly called with a ManagedPolicy
instead of a Role. ManagedPolicy does not implement IGrantable and cannot
be used as a Principal in IAM policies. This latent bug was exposed when
CDK 2.174.0 added validation that rejects ManagedPolicy as a principal.

The fix moves the grant call to after the Role is created and targets
the model_execution_role instead of model_execution_policy, aligning
with the pattern used elsewhere in this file and other sagemaker modules.

Fixes: Cannot use a ManagedPolicy as the 'Principal' in an IAM Policy

Author: weklund

CHANGELOG.md

@@ -11,6 +11,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ### **Changed**
 
+- fixed `sagemaker-templates` Model Deploy seed code incorrectly granting S3 permissions to a ManagedPolicy instead of a Role, which caused deployment failures with CDK 2.174.0+
 - update qs to 6.14.1 via npm override to address security vulnerability
 - pin @cdklabs/generative-ai-cdk-constructs to 0.1.311 to fix build compatibility
 - update starlette to 0.50.0 and fastapi to 0.128.0 to address security vulnerabilities

modules/sagemaker/sagemaker-templates/templates/model_deploy/seed_code/deploy_app/deploy_app/deploy_endpoint_stack.py

@@ -134,7 +134,6 @@ def __init__(
         )
 
         model_bucket = s3.Bucket.from_bucket_arn(self, "ModelBucket", MODEL_BUCKET_ARN)
-        model_bucket.grant_read_write(model_execution_policy)
 
         if ECR_REPO_ARN:
             model_execution_policy.add_statements(
@@ -152,6 +151,9 @@ def __init__(
             managed_policies=[model_execution_policy],
         )
 
+        # Grant S3 read/write permissions to the role (not the ManagedPolicy)
+        model_bucket.grant_read_write(model_execution_role)
+
         # setup timestamp to be used to trigger the custom resource update event to retrieve
         # latest approved model and to be used with model and endpoint config resources' names
         now = datetime.now().replace(tzinfo=timezone.utc)