botocore.exceptions.ClientError: An error occurred (ValidationException)

0

Hi,
I want to deploy an MLflow image to an AWS Sagemaker endpoint that contains a machine learning model. I executed the following code, which I found in https://towardsdatascience.com/deploying-models-to-production-with-mlflow-and-amazon-sagemaker-d21f67909198 .

import mlflow.sagemaker as mfs  
  
run_id = run_id # the model you want to deploy - this run_id was saved when we trained our model  
region = "us-east-1" # region of your account  
aws_id = "XXXXXXXXXXX" # from the aws-cli output  
arn = "arn:aws:iam::XXXXXXXXXXX:role/your-role"  
app_name = "iris-rf-1"  
model_uri = "mlruns/%s/%s/artifacts/random-forest-model" % (experiment_id,run_id) # edit this path based on your working directory  
image_url = aws_id _ ".dkr.ecr." _ region + ".amazonaws.com/mlflow-pyfunc:1.2.0" # change to your mlflow version  
  
mfs.deploy(app_name=app_name,   
           model_uri=model_uri,   
           region_name=region,   
           mode="create",  
           execution_role_arn=arn,  
           image_url=image_url)  

But I got the following error. I checked all policies and permissions attached to the IAM role. They all comply with what the error message complains about. I don't know what to do next. I'd appreciate your help. Thanks.

botocore.exceptions.ClientError: An error occurred (ValidationException) when calling the CreateModel operation: Could not access model data at https://s3.amazonaws.com/mlflow-sagemaker-us-east-1-xxx/mlflow-xgb-demo-model-eqktjeoit5mxhmjn-abpanw/model.tar.gz. Please ensure that the role "arn:aws:iam::xxx:role/mlflow-sagemaker-dev" exists and that its trust relationship policy allows the action "sts:AssumeRole" for the service principal "sagemaker.amazonaws.com". Also ensure that the role has "s3:GetObject" permissions and that the object is located in us-east-1.

asked 3 years ago2810 views
1 Answer
0

I found the root cause. I had to go to "Trust relationship" section of the IAM role and then add "sagemaker.amazonaws.com" to the service principal.

answered 3 years ago

You are not logged in. Log in to post an answer.

A good answer clearly answers the question and provides constructive feedback and encourages professional growth in the question asker.

Guidelines for Answering Questions