如何對在 SageMaker AI Studio 中執行排程筆記本作業時，收到的錯誤進行疑難排解？

解決方法

AccessDenied 錯誤疑難排解

當排程筆記本作業嘗試執行時，您可能會因為以下原因收到「AccessDenied」錯誤：

• 您沒有必要的 AWS Identity and Access Management (IAM) 政策。
• 您沒有必要的 Amazon Virtual Private Cloud (Amazon VPC) 端點政策。
• 您有資源標籤例外狀況。

IAM 政策問題

請確定您的筆記本在 IAM 角色上已附加以下政策，以允許基本信任關係：

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {
        "Service": "sagemaker.amazonaws.com"
      },
      "Action": "sts:AssumeRole"
    },
    {
      "Effect": "Allow",
      "Principal": {
        "Service": "events.amazonaws.com"
      },
      "Action": "sts:AssumeRole"
    }
  ]
}

請確認您的 IAM 角色具有以下權限：

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": "iam:PassRole",
      "Resource": "arn:aws:iam::*:role/*",
      "Condition": {
        "StringLike": {
          "iam:PassedToService": [
            "sagemaker.amazonaws.com",
            "events.amazonaws.com"
          ]
        }
      }
    },
    {
      "Effect": "Allow",
      "Action": [
        "events:TagResource",
        "events:DeleteRule",
        "events:PutTargets",
        "events:DescribeRule",
        "events:PutRule",
        "events:RemoveTargets",
        "events:DisableRule",
        "events:EnableRule"
      ],
      "Resource": "*",
      "Condition": {
        "StringEquals": {
          "aws:ResourceTag/sagemaker:is-scheduling-notebook-job": "true"
        }
      }
    },
    {
      "Effect": "Allow",
      "Action": [
        "s3:CreateBucket",
        "s3:PutBucketVersioning",
        "s3:PutEncryptionConfiguration"
      ],
      "Resource": "arn:aws:s3:::sagemaker-automated-execution-*"
    },
    {
      "Effect": "Allow",
      "Action": [
        "sagemaker:ListTags"
      ],
      "Resource": [
        "arn:aws:sagemaker:*:*:user-profile/*",
        "arn:aws:sagemaker:*:*:space/*",
        "arn:aws:sagemaker:*:*:training-job/*",
        "arn:aws:sagemaker:*:*:pipeline/*"
      ]
    },
    {
      "Effect": "Allow",
      "Action": [
        "sagemaker:AddTags"
      ],
      "Resource": [
        "arn:aws:sagemaker:*:*:training-job/*",
        "arn:aws:sagemaker:*:*:pipeline/*"
      ]
    },
    {
      "Effect": "Allow",
      "Action": [
        "ec2:CreateNetworkInterface",
        "ec2:CreateNetworkInterfacePermission",
        "ec2:CreateVpcEndpoint",
        "ec2:DeleteNetworkInterface",
        "ec2:DeleteNetworkInterfacePermission",
        "ec2:DescribeDhcpOptions",
        "ec2:DescribeNetworkInterfaces",
        "ec2:DescribeRouteTables",
        "ec2:DescribeSecurityGroups",
        "ec2:DescribeSubnets",
        "ec2:DescribeVpcEndpoints",
        "ec2:DescribeVpcs",
        "ecr:BatchCheckLayerAvailability",
        "ecr:BatchGetImage",
        "ecr:GetDownloadUrlForLayer",
        "ecr:GetAuthorizationToken",
        "s3:ListBucket",
        "s3:GetBucketLocation",
        "s3:GetEncryptionConfiguration",
        "s3:PutObject",
        "s3:DeleteObject",
        "s3:GetObject",
        "sagemaker:DescribeDomain",
        "sagemaker:DescribeUserProfile",
        "sagemaker:DescribeSpace",
        "sagemaker:DescribeStudioLifecycleConfig",
        "sagemaker:DescribeImageVersion",
        "sagemaker:DescribeAppImageConfig",
        "sagemaker:CreateTrainingJob",
        "sagemaker:DescribeTrainingJob",
        "sagemaker:StopTrainingJob",
        "sagemaker:Search",
        "sagemaker:CreatePipeline",
        "sagemaker:DescribePipeline",
        "sagemaker:DeletePipeline",
        "sagemaker:StartPipelineExecution"
      ],
      "Resource": "*"
    }
  ]
}

如需詳細資訊，請參閱 SageMaker AI 筆記本的 AWS 受管政策。

VPC 端點問題

如果您透過 Amazon VPC 端點啟動筆記本作業，請檢查該端點的組態與政策。請確定您已完成必要步驟，並遵循相關 AWS 服務端點的最佳實務：

• Amazon Elastic Compute Cloud (Amazon EC2)
• Amazon EventBridge
• SageMaker AI
• Amazon Simple Storage Service (Amazon S3)

對於 Amazon S3 VPC 端點，您可能會收到與僅限單一 AWS 帳戶的端點相關的錯誤。例如，以下政策會將存取限制在帳戶 ID 為 111122223333 的帳戶：

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "AllowSpecificAccountsPermission",
      "Effect": "Allow",
      "Principal": {
        "AWS": "*"
      },
      "Action": "s3:*",
      "Resource": "*",
      "Condition": {
        "StringEquals": {
          "s3:ResourceAccount": "111122223333"
        }
      }
    }
  ]
}

若要解決此問題，您也必須允許以下 S3 儲存貯體存取，以供使用者動作使用：

{
  "Action": [
    "s3:*"
  ],
  "Resource": [
    "arn:aws:s3:::sagemakerheadlessexecution-prod-*",
    "arn:aws:s3:::sagemakerheadlessexecution-prod-*/*"
  ],
  "Effect": "Allow",
  "Sid": "SCTASK14554266"
}

資源標籤例外狀況

請確定您的 IAM 政策具有以下權限：

{
  "Effect": "Allow",
  "Action": [
    "events:TagResource",
    "events:DeleteRule",
    "events:PutTargets",
    "events:DescribeRule",
    "events:PutRule",
    "events:RemoveTargets",
    "events:DisableRule",
    "events:EnableRule"
  ],
  "Resource": "*",
  "Condition": {
    "StringEquals": {
      "aws:ResourceTag/sagemaker:is-scheduling-notebook-job": "true"
    }
  }
}

UI 錯誤疑難排解

當您嘗試建立、描述、更新、停止，或刪除筆記本作業時，您可能會收到 UI 錯誤。當您使用作業定義 (排程作業) 時，也可能會收到此錯誤。若要進行疑難排解，請查看 UI 中顯示的錯誤訊息。此訊息可能包含解決問題的說明或建議動作。

如果您無法解決錯誤，請完成以下步驟：

1. 擷取錯誤畫面的螢幕截圖，並將其儲存為影像檔案。
2. 建立 HTTP Archive (HAR) 檔案，以擷取 UI 錯誤發生時的網路流量。
3. 開啟 SageMaker AI Studio Jupyter 伺服器終端。選擇 File, New, Terminal (檔案、新增、終端)。
4. 在 UI 錯誤發生的時間點，檢查 /var/log/apps/app_container.log 中是否有例外狀況、錯誤或警告。
5. 聯絡 AWS Support。在您的請求中，請附上錯誤螢幕截圖、app_container.log，以及 HAR 檔案。