SageMaker IAM Preflight Every SageMaker resource needs an execution role — the IAM role SageMaker assumes to read model artifacts from S3, pull serving containers from ECR, and write logs. Most deployments fail here because the script tried to create a new role without checking if a usable one already existed, then blew up because the caller is an SSO principal. This skill encodes the right order: discover, validate, only create if necessary. Running the helpers (cross-platform) The helpers are Python so they run identically on Windows, macOS, and Linux: Run them from the shell where the AWS…