SageMaker Resource Explorer (sm-explorer)

Disclaimer: This is a personal project. It is not production-ready, not affiliated with any employer, and should not be considered work-related code.

Discover, visualize, stop, and delete SageMaker resources in your AWS account, including underlying resources (EBS, EFS, S3, ENIs, CloudWatch Logs) that SageMaker creates.

---

Install

pip install git+https://github.com/poojak13/sm-resource-explorer.git

Or from source:

git clone https://github.com/poojak13/sm-resource-explorer.git
cd sm-resource-explorer
pip install -e .

If sm-explorer is not found after install, use python -m sm_explorer.cli instead.

---

Quick Start

sm-explorer <ACCOUNT_ID> list                         # See everything
sm-explorer <ACCOUNT_ID> list --active-only           # What's costing me money?
sm-explorer <ACCOUNT_ID> list --type <RESOURCE>       # Filter by resource type
sm-explorer <ACCOUNT_ID> graph                        # Dependency tree
sm-explorer <ACCOUNT_ID> stop --all-running           # Stop all running resources
sm-explorer <ACCOUNT_ID> delete --dry-run             # Preview what delete would do

---

Command Cheat Sheet

What you want to do	Command
List all resources	sm-explorer <ID> list
List only running	sm-explorer <ID> list --status running
List only what's being charged	sm-explorer <ID> list --active-only
List specific resource type	sm-explorer <ID> list --type <RESOURCE>
List only SageMaker (hide EBS/EFS/S3/Logs)	sm-explorer <ID> list --sagemaker-only
Full-width output	sm-explorer <ID> list --wide
Export as CSV	sm-explorer <ID> list --format csv -o output.csv
Export as JSON	sm-explorer <ID> list --format json -o output.json
Show dependency tree	sm-explorer <ID> graph
Stop running specific resource type	sm-explorer <ID> stop --type <RESOURCE>
Stop everything running	sm-explorer <ID> stop --all-running
Delete specific resource type	sm-explorer <ID> delete --type <RESOURCE>
Delete a specific resource	sm-explorer <ID> delete --resource-id <ARN>
Delete everything	sm-explorer <ID> delete --all
Preview delete (safe)	sm-explorer <ID> delete --type <RESOURCE> --dry-run
Use a different region	sm-explorer --region us-west-2 <ID> list
Use a different profile	sm-explorer --profile dev <ID> list

Replace <ID> with your 12-digit AWS account number. Replace <RESOURCE> with a type from the reference table below.

⚠️ WARNING: Deletion is permanent and cannot be undone. All data, configurations, model artifacts, and training outputs are lost forever. The authors of this tool are not responsible for any data loss. Always use --dry-run first.

---

Reference

Resource Types

Use these values with --type (case-insensitive):

SageMaker Resources	Underlying Resources
NotebookInstance	Volume (EBS)
Domain	FileSystem (EFS)
UserProfile	Bucket (S3)
Space	LogGroup (CloudWatch)
App (JupyterLab, CodeEditor, Canvas, etc.)	SecurityGroup
Endpoint	NetworkInterface (ENI)
EndpointConfig
Model
InferenceComponent
TrainingJob
HyperParameterTuningJob
ProcessingJob
TransformJob
Pipeline
PipelineExecution
ModelPackageGroup
ModelPackage
FeatureGroup
Experiment
Trial
MlflowTrackingServer
Cluster (HyperPod)
ClusterNode
MonitoringSchedule

What Gets Charged vs Not

Actively Charged	Not Charged
Running notebooks	Stopped notebooks (compute)
Active endpoints	User profiles
In-progress jobs	Endpoint configs, models
Studio apps (JupyterLab, CodeEditor, Canvas)	Experiments, trials
EBS volumes	Pipelines (metadata)
EFS file systems	Model packages
S3 storage	Lifecycle configs
CloudWatch logs	Security groups, ENIs

What Can Be Stopped

Resource	What happens
NotebookInstance	InService -> Stopped (EBS preserved)
App (JupyterLab, CodeEditor, Canvas, etc.)	Deleted, data in EFS/EBS preserved
TrainingJob	InProgress -> Stopped
ProcessingJob	InProgress -> Stopped
TransformJob	InProgress -> Stopped
HyperParameterTuningJob	InProgress -> Stopped

Endpoints cannot be stopped, only deleted.

---

Setup

Prerequisites

• Python 3.9+
• AWS credentials configured (aws configure)
• IAM permissions (docs/iam-policy.md)

Verify credentials

aws sts get-caller-identity

The Account field is your account ID.

Region

Uses your AWS config region by default. Falls back to us-east-1. Override with --region.

PATH troubleshooting

# Option 1: Use python module syntax
python -m sm_explorer.cli <ACCOUNT_ID> <COMMAND>

# Option 2: Find Scripts folder and add to PATH
python -c "import sysconfig; print(sysconfig.get_path('scripts'))"

IAM Permissions

Read-only (list, graph, export): sagemaker:List*, sagemaker:Describe*, ec2:Describe*, efs:Describe*, logs:DescribeLogGroups, s3:ListBucket, sts:GetCallerIdentity

Full access (adds stop/delete): Above + sagemaker:Delete*, sagemaker:Stop*, ec2:Delete*, efs:Delete*, logs:DeleteLogGroup, s3:DeleteObject

Full policy JSON: docs/iam-policy.md

---

Security

• Only reads your own account using your own credentials
• No data sent to external services
• Export files contain account-specific info, don't share publicly
• Never stores credentials

Contributing

See CONTRIBUTING.md