QuickSight "Build a predictive model" fails – role assumed but no SageMaker API calls

Question

Hi AWS team,

I’m trying to use the QuickSight "Build a predictive model" feature (ML Insights with SageMaker Canvas integration), but it consistently fails with the banner message:

> "A SageMaker domain needs to be selected before you can build a predictive model."

Here is what I have set up:
* Region: eu-central-1 (Frankfurt)
* QuickSight edition: Enterprise
* SageMaker domain: AuthMode = SSO, Status = InService
* Canvas app: Status = InService
* QuickSight service role: custom role (quicksight-common-eu-permissions) with trust to quicksight.amazonaws.com.
   * IAM policy includes SageMaker list/describe permissions (ListDomains, DescribeDomain, ListUserProfiles, DescribeUserProfile, ListApps, DescribeApp, ListPartnerApps, DescribePartnerApp, CreatePartnerAppPresignedUrl, ListSharedModelEvents, ListEndpoints) and S3 access to the artifacts bucket.

What I observe in CloudTrail:
* In QuickSight Security & permissions, the SageMaker domain is selected.
* When I hit Save there, CloudTrail only shows UpdateResourcePermissions events in QuickSight, no SageMaker API calls.
* When I try Build a predictive model:
  * QuickSight does assume my role (quicksight-common-eu-permissions) — CloudTrail shows sts:AssumeRole events from quicksight.amazonaws.com.
  * After that, there are no sagemaker.amazonaws.com API calls from this role.
* I do see SageMaker API calls from the Canvas exec role, including calls like ListSharedModelEvents. So Canvas itself works when launched directly. 
* After fixing IAM permissions earlier (resolving AccessDenied errors), I no longer see any errors between QuickSight and SageMaker in CloudTrail. The issue is simply that QuickSight does not make the calls at all.

Troubleshooting done:
* Verified the role policy with aws iam simulate-principal-policy → permissions are allowed.
* Verified Canvas works standalone (can launch, create models manually).
* Tried with both a custom QuickSight service role and the default AWS managed role (aws-quicksight-service-role-v0). In both cases, the behavior is the same: QuickSight assumes the role, but does not make any SageMaker API calls, and the integration fails with the “select a domain” error.

Problem:
QuickSight assumes the role successfully, the SageMaker domain is selected in the settings, and there are no permission errors anymore. But QuickSight never calls SageMaker APIs (e.g. ListDomains, DescribeDomain, ListUserProfiles) after assuming the role. As a result, the "Build a predictive model" flow never progresses, even though Canvas is fully functional on its own.

Question:
Is this a known limitation/bug with QuickSight + SageMaker Canvas integration on SSO domains?
What is required to make QuickSight actually call SageMaker after assuming the role, so the one-click "Build a predictive model" flow works?

Thanks in advance!

Manvitha Potluri · Answer

Suggested Fixes and Workarounds
✅ 1. Check that QuickSight is SSO-Integrated

Go to:
QuickSight Console → Security & Permissions → Manage → IAM Identity Center (SSO)
Ensure:
Identity Center is enabled and linked

The user who’s accessing QuickSight is provisioned via Identity Center
That user also has access to SageMaker Canvas (license enabled under SSO)

✅ 2. Try Creating a New SageMaker Domain in IAM Mode (for Testing)
As a test:
Create a SageMaker domain with AuthMode = IAM (not SSO).
Use an IAM user with AmazonSageMakerFullAccess.
See if the “Build a predictive model” button works via QuickSight in that setup.
If it works there, this proves the issue is with SSO + domain visibility, not your IAM role or permissions.

✅ 3. Open an AWS Support Ticket – Reference SSO Bug
This might be a known issue or limitation with QuickSight + SSO + Canvas integration, especially for accounts with custom roles and SSO domains.
When opening the ticket, mention:
The AssumeRole is happening, but no SageMaker API calls are triggered.
The domain is SSO-authenticated and Canvas works directly.
You’ve verified policies, region alignment, visual type, and no CloudTrail Deny events.
You're in eu-central-1.

You can reference a similar issue that AWS Support has acknowledged in the past as a Canvas-QuickSight backend bug affecting accounts with:

SSO-only domains

Regional Canvas provisioning (e.g. in eu-central-1, ca-central-1, etc.)

========================================================
Here’s what’s fully valid and safe to try, with no risk to your environment:

1. Test with an IAM-authenticated SageMaker Domain
This isolates the issue: if it works, the problem is clearly with SSO domain compatibility in QuickSight.
It’s a safe, temporary test and doesn’t interfere with your existing SSO domain.
2. Open an AWS Support Ticket
This is the most likely path to a fix.
Your case sounds like a classic backend bug or undocumented limitation.
AWS support can confirm if this is a known limitation with SSO domains + Canvas + QuickSight in Frankfurt (eu-central-1).

re:Post Agent · Answer

Based on your description, it appears you're encountering an issue with the QuickSight and SageMaker integration for ML Insights. Let me address the potential causes and solutions:

First, ensure that your IAM role has the complete set of permissions required for QuickSight to interact with SageMaker. The `AWSQuickSightSageMakerPolicy` managed policy includes specific permissions that might be missing from your custom role:

1. `s3:GetObject` permissions on Amazon QuickSight-owned S3 buckets with the prefix `arn:aws:s3:::quicksight-ml`
2. SageMaker permissions including `sagemaker:CreateTransformJob`, `sagemaker:DescribeTransformJob`, and `sagemaker:StopTransformJob`
3. `sagemaker:ListModels` permission to list your SageMaker AI models

Since you're seeing QuickSight assume the role but not make any SageMaker API calls, there could be a trust relationship issue. Verify that your IAM role has the correct trust policy allowing QuickSight to assume the role:

```
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Principal": {
"Service": "quicksight.amazonaws.com"
},
"Action": "sts:AssumeRole"
}
]
}
```

For SSO-authenticated SageMaker domains, there might be additional configuration requirements. The error message "A SageMaker domain needs to be selected before you can build a predictive model" suggests that QuickSight isn't properly recognizing your SageMaker domain despite it being selected in the settings.

Another possibility is that there might be an issue with the SageMaker domain configuration itself. Ensure that your SageMaker domain is properly set up and that the Canvas application is correctly configured for integration with QuickSight.

If you've verified all these settings and the issue persists, it could be a service limitation or a bug in the integration between QuickSight and SageMaker Canvas when using SSO authentication. In this case, you may need to contact AWS Support for further assistance, as this appears to be a specific integration issue rather than a general permission problem.  
**Sources**  
[AWS managed policies for Amazon QuickSight - Amazon QuickSight](https://docs.aws.amazon.com/quicksight/latest/user/security-iam-quicksight.html)  
[Prerequisites - Amazon QuickSight](https://docs.aws.amazon.com/quicksight/latest/user/security-create-iam-role-prerequisites.html)

QuickSight "Build a predictive model" fails – role assumed but no SageMaker API calls

Add your answer

Relevant content