AWS Policy that allows only one SSO user to access a resource

Question

We are in a process to move all of our IAM users to aws SSO we used to have this IAM policy for sagemaker :

"

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "VisualEditor0",
            "Effect": "Allow",
            "Action": [
                "sagemaker:ListTags",
                "sagemaker:DeleteNotebookInstance",
                "sagemaker:StopNotebookInstance",
                "sagemaker:CreatePresignedNotebookInstanceUrl",
                "sagemaker:DescribeNotebookInstance",
                "sagemaker:StartNotebookInstance",
                "sagemaker:UpdateNotebookInstance"
            ],
            "Resource": "arn:aws:sagemaker:::notebook-instance/${aws:username}*"
        },
        {
            "Sid": "VisualEditor1",
            "Effect": "Allow",
            "Action": [
                "sagemaker:ListNotebookInstanceLifecycleConfigs",
                "sagemaker:ListNotebookInstances",
                "sagemaker:ListCodeRepositories"
            ],
            "Resource": "*"
        }
    ]
}
"

this would give access to each user to use his\hers own notebook in sagemaker now on the new SSO permission set i gave this:

"
{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "glue:CreateScript",
                "secretsmanager:*"
            ],
            "Resource": "*"
        },
        {
            "Effect": "Allow",
            "Action": [
                "sagemaker:ListTags",
                "sagemaker:DeleteNotebookInstance",
                "sagemaker:StopNotebookInstance",
                "sagemaker:CreatePresignedNotebookInstanceUrl",
                "sagemaker:Describe*",
                "sagemaker:StartNotebookInstance",
                "sagemaker:UpdateNotebookInstance",
                "sagemaker:CreatePresignedDomainUrl",
                "sagemaker:*"
            ],
            "Resource": "arn:aws:sagemaker:::notebook-instance/*",
            "Condition": {
                "StringEquals": {
                    "aws:ResourceTag/Owner": "${identitystore:UserId}"
                }
            }
        },
        {
            "Effect": "Allow",
            "Action": [
                "sagemaker:ListTags",
                "sagemaker:Describe*",
                "sagemaker:StartNotebookInstance"
            ],
            "Resource": "*"
        }
    ]
}
"

this is what i tried but i cant make it work please assist? i also treid using the attributes and many other things but i just cant make it work please if you have any suggestions

Answer 1

apprently on the SSO permission set we must write the region and account number of the resource so the fix was just adding that to the resource part like this

{
"Version": "2012-10-17",
"Statement": [
    {
        "Effect": "Allow",
        "Action": [
            "glue:CreateScript",
            "secretsmanager:*"
        ],
        "Resource": "*"
    },
    {
        "Effect": "Allow",
        "Action": [
            "sagemaker:ListTags",
            "sagemaker:DeleteNotebookInstance",
            "sagemaker:StopNotebookInstance",
            "sagemaker:CreatePresignedNotebookInstanceUrl",
            "sagemaker:Describe*",
            "sagemaker:StartNotebookInstance",
            "sagemaker:UpdateNotebookInstance",
            "sagemaker:CreatePresignedDomainUrl"
        ],
        "Resource": "arn:aws:sagemaker:us-east-1:7XXXXXXXXX:notebook-instance/*",
        "Condition": {
            "StringEquals": {
                "sagemaker:ResourceTag/Owner": "${identitystore:UserId}"
            }
        }
    },
    {
        "Sid": "VisualEditor1",
        "Effect": "Allow",
        "Action": [
            "sagemaker:ListNotebookInstanceLifecycleConfigs",
            "sagemaker:ListNotebookInstances",
            "sagemaker:ListCodeRepositories"
        ],
        "Resource": "*"
    }
]

}

thanks to Yash_c from repost.aws