Identifies the first occurrence of a specific IAM execution role being passed to an Amazon SageMaker resource by a principal, via CreateNotebookInstance, CreateTrainingJob, CreateProcessingJob, CreateAutoMLJob, or CreatePipeline. These actions require iam:PassRole and cause the created resource to run as the passed role. The detector keys on the combination of the caller (principal) and the passed role ARN, flagging when a principal uses a given execution role for the first time within the last 7 days. Cross-account or higher-privilege roles, or roles from a different account, are considered especially suspicious. Implemented queries filter CloudTrail events from sagemaker.amazonaws.com for the five actions, exclude AWS service principals, extract the roleArn from request_parameters, and derive the principal ARN. It then aggregates by principal and role ARN to surface new combinations within a recent window (ingested_min >= NOW() - 10 minutes). The rule surfaces contextual fields to aid investigation (actor ARN, role ARN, identity values, timestamps, and environment). If triggered, investigators should assess whether the principal’s SageMaker usage is approved and whether the passed role’s privileges are appropriate. Mitigations include tightening iam:PassRole scopes, enforcing least privilege on SageMaker execution roles, and rotating credentials if compromise is suspected.