SageMaker Studio refuses to open with error "SageMaker is not authorized to perform GetTaskCredentials"

Did you enable Trusted Identity Propagation when you created the domain? If yes, make sure you update the corresponding execution role according to this doc: https://docs.aws.amazon.com/sagemaker/latest/dg/trustedidentitypropagation-setup.html (I have exactly the same error when enabling TIP and using the default generated role policy. After the update the problem is gone).

This error occurs when SageMaker Studio cannot acquire the necessary credentials due to IAM permission issues. Based on the error message, there are two likely causes:

1. Missing trust relationship: The execution role used by SageMaker Studio needs to have a trust relationship that allows the SageMaker service (sagemaker.amazonaws.com) to assume the role. Check your execution role's trust policy to ensure it includes this trust relationship.

2. Missing or improperly configured tag permissions: SageMaker Studio requires the ability to use session tags. Even though you've added sts:TagSession permission, there might be other configuration issues.

Here are some steps to troubleshoot:

1. Verify the trust relationship in your execution role. It should include:

{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Principal": {
"Service": "sagemaker.amazonaws.com"
},
"Action": "sts:AssumeRole"
}
]
}

2. For user profiles in SageMaker Studio, ensure they are properly tagged. When creating a user profile, it should be tagged with the SageMaker Studio user name using the tag key studiouserid. The principal (user or role) should also have a matching tag with the key studiouserid.

3. Attach a policy to the user role that includes the necessary permissions for creating presigned URLs:

{
"Version": "2012-10-17",
"Statement": [
{
"Sid": "AmazonSageMakerPresignedUrlPolicy",
"Effect": "Allow",
"Action": [
"sagemaker:CreatePresignedDomainUrl"
],
"Resource": "*",
"Condition": {
"StringEquals": {
"sagemaker:ResourceTag/studiouserid": "${aws:PrincipalTag/studiouserid}"
}
}
}
]
}

4. Try clearing your browser cookies and cache, or use an incognito/private browsing window, as authentication tokens might be expired or invalid.

5. If you're still experiencing issues, you can try generating a presigned URL using the AWS CLI to access SageMaker Studio:

aws sagemaker create-presigned-domain-url --domain-id your-domain-id --user-profile-name your-profile-name

If these steps don't resolve the issue, you may need to contact AWS Support for further assistance, as there might be specific configuration requirements for your SSO setup with SageMaker Studio.
Sources
Permissions management - SageMaker Studio Administration Best Practices
Troubleshooting Amazon SageMaker AI Identity and Access - Amazon SageMaker AI
Unable to Access SageMaker Studio | AWS re:Post