fix: Allow sagemaker to have the proper IAM permission to autostop itself

[nguyen102]

Issue #, if available:

Description of changes:

• Update permission boundary for Sagemaker instance to allow stopping a Sagemaker instance
• Change Sagemaker to check whether idle limit has passed, on a minute by minute cadence instead of an hourly cadence
• Update envStatusPollHandler to run once every minute instead of once every 3 minutes. (More accurate, since users can choose to have Sagemaker stop itself after 1 minute of inactivity)

I tested that Sagemaker was able to stop itself after inactivity. I saw the Sagemaker instance was stopped on the AWS Console and within SWB UI.

Checklist:

• Have you successfully deployed to an AWS account with your changes?
• Have you written new tests for your core changes, as applicable?
• Have you successfully tested with your changes locally?
• If new dependencies have been added, have they been pinned to specific versions?
• Is this change also required on the AWS Solution version?
• Have you updated openapi.yaml if you made updates to API definition (including add, delete or update parameter and request data schema)?
• If you had to run manual tests, have you considered automating those tests by adding them to end-to-end tests?

AS review ticket id:

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.

[codecov]

Codecov Report

Merging #515 (13c8d03) into develop (e99ecca) will not change coverage.
The diff coverage is n/a.

❗ Current head 13c8d03 differs from pull request most recent head efcb8d8. Consider uploading reports for the commit efcb8d8 to get more accurate results

@@           Coverage Diff            @@
##           develop     #515   +/-   ##
========================================
  Coverage    49.04%   49.04%           
========================================
  Files          243      243           
  Lines        12503    12503           
  Branches      2012     2012           
========================================
  Hits          6132     6132           
  Misses        5564     5564           
  Partials       807      807           

---

Continue to review full report at Codecov.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update e99ecca...efcb8d8. Read the comment docs.

[jn1119]

Can we restrict the resource here?

[jn1119]

Can the reference be - !Ref BasicNotebookInstance?

[nguyen102]

I don't think we can reference it because the notebook is created after this policy is created. More info here. Also since this is a permission boundary I think it's ok to have a broader resource section here. In the actual Sagemaker IAM role, we do scope the permission down to just the notebook.

[jn1119]

Yeah, that's what I was trying to understand. If the IAM policy can reference the instance then why can't permission boundary policy do the same.

I think it's ok to have a broader resource section here. In the actual Sagemaker IAM role, we do scope the permission down to just the notebook.

Yeah, that's why I approved the change. But I am still curious if it could have been done just like we did with IAM policy