0

I am trying to create a SageMaker Project in SageMaker Studio, but I keep getting the following error:

You are not authorized to use the Amazon SageMaker project templates. Please contact your administrator to authorize you to use them.

I have already attached the following IAM policies to my SageMaker execution role:

  • AmazonSageMakerFullAccess
  • AWSServiceCatalogEndUserFullAccess
  • AmazonSageMakerServiceCatalogProductsApiGatewayServiceRolePolicy
  • AmazonSageMakerServiceCatalogProductsCloudformationServiceRolePolicy
  • AmazonSageMakerServiceCatalogProductsCodeBuildServiceRolePolicy
  • AmazonSageMakerServiceCatalogProductsCodePipelineServiceRolePolicy
  • AmazonSageMakerServiceCatalogProductsEventsServiceRolePolicy
  • AmazonSageMakerServiceCatalogProductsGlueServiceRolePolicy
  • AmazonSageMakerServiceCatalogProductsLambdaServiceRolePolicy

Additionally, my IAM trust policy for the execution role is:

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Principal": {
                "Service": [
                    "sagemaker.amazonaws.com",
                    "servicecatalog.amazonaws.com"
                ]
            },
            "Action": "sts:AssumeRole"
        }
    ]
}

Things I Have Tried:

  1. Checked SageMaker Studio settings: My SageMaker Domain has Projects enabled.
  2. Restarted SageMaker Studio to apply permission changes.
  3. Ensured my IAM role is correctly assigned to SageMaker Studio.

Despite all of this, I still get the same error.

Question:

What am I missing? Are there additional permissions or configurations required to create SageMaker projects?

4
  • if this is an organization account, try checking Service control policies. Commented Feb 6 at 16:13
  • as previously mentioned, it might a service control policy. Can you try also, if you have permissions for this, to attach administrator access policy to your role? This is to see if there are permissions missing. It might be also helpful to take a look at cloudtrail to see if the message there is more informative. Commented Feb 7 at 10:19
  • @FranciscoParrilla I attached administrator access policy to the role but still getting the same error You are not authorized to use the Amazon SageMaker project templates. Please contact your administrator to authorize you to use them. Commented Feb 11 at 15:15
  • is this account part of an organization? @Mohamed Commented Feb 12 at 15:17

1 Answer 1

0

There are multiple possible causes but most likely cause is missing explicit permission to AssumeRole for AmazonSageMakerServiceCatalogProductsLaunchRole.

    "Statement": [
        {
            "Effect": "Allow",
            "Action": "sts:AssumeRole",
            "Resource": "arn:aws:iam::*:role/AmazonSageMakerServiceCatalogProductsLaunchRole"
        }
    ]

Please try to add this permission.

Sign up to request clarification or add additional context in comments.

Comments

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Start asking to get answers

Find the answer to your question by asking.

Ask question

Explore related questions

See similar questions with these tags.