Reason why errors occur when starting SageMaker Studio

Question

Hello!
I have a question about errors found when starting SageMaker Studio (below). 
****
 AccessDeniedException
 User: X is not auth**orized to perform: sagemaker:CreateDomain on resource: arn:aws:sagemaker:ap-northeast-1:XX because no identity-based policy allows the sagemaker:CreateDomain action
 
 ValidationException
 Access denied in getting/deleting the portfolio shared by SageMaker. Please call withservicecatalog:ListAcceptedPortfolioShares permission.
 
 AccessDeniedException
 User: X is not authorized to perform: sagemaker:CreateUserProfile on resource: arn:aws:sagemaker:ap-northeast-1:XX because no identity-based policy allows the sagemaker:CreateUserProfile action

****
I resolved the errors by adding some inline policies, but I cannot understand the reason why the errors occur on my user with S3 Full Access and SageMaker Full Access policies.

I'd happy to tell me any information about the errors. Thank you!

Answer

As far as I know, according the [aws docs](https://docs.aws.amazon.com/sagemaker/latest/dg/sagemaker-roles.html#sagemaker-roles-createdomain-perms) the passRole action should be granted to the SageMake execution role for some cases such as creating images. So your s3:* and sagemaker:* is not enough, but still need to add iam:passRole to policies

Reason why errors occur when starting SageMaker Studio

Relevant content