Remote Access in SageMaker CodeEditor doesn't work

The error you're encountering is due to missing permissions required for remote access to SageMaker spaces. When using the "Open in VS Code" button (deep link access), your execution role needs specific permissions to perform the sagemaker:StartSession action.

To resolve this issue, you need to attach the appropriate IAM policy to your identity. Since you're using IAM Identity Center, you'll need to add the necessary permissions to your Permission sets. Here's what you need to do:

1. Ensure the following policy is attached to your Permission sets managed by IAM Identity Center:

{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": [
"sagemaker:ListSpaces",
"sagemaker:DescribeSpace",
"sagemaker:UpdateSpace",
"sagemaker:ListApps",
"sagemaker:CreateApp",
"sagemaker:DeleteApp",
"sagemaker:DescribeApp",
"sagemaker:StartSession",
"sagemaker:DescribeDomain",
"sagemaker:AddTags"
],
"Resource": "*"
}
]
}

For production environments, it's recommended to scope down these permissions to specific resources rather than using the wildcard "*".

After updating the permissions, you should be able to use the "Open in VS Code" button successfully. Remember that remote access must be set to "ENABLED" for the space, which you've already done by toggling it on.

Alternatively, you could also connect using the AWS Toolkit for Visual Studio Code or an SSH terminal connection if those methods better suit your workflow.
Sources
Set up remote access - Amazon SageMaker AI
Connect your local Visual Studio Code to SageMaker spaces - Amazon SageMaker AI
SpaceSettings - Amazon SageMaker