This project requires more permissions than AmazonSageMakerFullAccess gives it

[tedivm]

Describe the bug

Extremely basic code examples from the website don't work.

To reproduce
Create a new notebook with the following code:

import boto3
import sagemaker
import sagemaker.session

sagemaker_session = sagemaker.session.Session()
role = sagemaker.get_execution_role()

Run it and get this error:

Couldn't call 'get_role' to get Role ARN from role name ROLENAME to get Role path.

Expected behavior

Either the policy should be fixed, or the documentation should be upgraded to tell people what additional permissions they will need.

Screenshots or logs

System information
A description of your system. Please provide: Sagemaker Studio with no extra installs or changes.

Additional context

This problem has apparently come up before (#291 #305 #575).

We are not using a local setup for this, but are running on Sagemaker directly.

[aaronmarkham]

Did you try granting permission for iam:GetRole?

[tedivm]

We added "iam:GetRole", "iam:GetRolePolicy", "sts:GetCallerIdentity" and it worked.

[TEChopra1000]

@tedivm I'll resolve this issue as it appears that you have found a solution. Please reopen if needed.

[tedivm]

Well yeah I found a solution, but you should probably fix the underlying problem- either in the documentation or in your policies themselves.

[tedivm]

You also don't allow people who aren't members of this project reopen tickets.

[TEChopra1000]

@tedivm good point and your right, my apologies! I didn't realize you weren't allowed to reopen it the ticket. I'll do so now.

[oonisim]

Apparently the issues has not been addressed yet? Please fix if it has not yet because this is an essential step and will waste so much time of all the SageMaker users.

• aws sagemaker - IAM permission to call get_role

[IvyBazan]

This prerequisite is currently identified in the following documentation:
https://docs.aws.amazon.com/sagemaker/latest/dg/gs-set-up.html