Does not have BatchGetImage permission - While deploying model in sagemaker

user_10937416 0
Viewed 1045

I am Able to train my modelusing Sagemaker TensorFlow container.

Below is the code:

model_dir = '/opt/ml/model'
train_instance_type = 'ml.c4.xlarge'
hyperparameters = {'epochs': 10, 'batch_size': 256, 'learning_rate': 0.001}

script_mode_estimator = TensorFlow(
    entry_point='model.py',
    train_instance_type=train_instance_type,
    train_instance_count=1,
    model_dir=model_dir,
    hyperparameters=hyperparameters,
    role=sagemaker.get_execution_role(),
    base_job_name='tf-fashion-mnist',
    framework_version='1.12.0',
    py_version='py3',
    output_path='s3://my_bucket/testing',
    script_mode=True
)

Model Fitting:

script_mode_estimator.fit(inputs)

But when i ama trying to deploy model i ama getting this below error:

Deploy code is:

script_mode_d=script_mode_estimator.deploy(initial_instance_count=1,
                 instance_type="ml.m4.xlarge")

Error is:

UnexpectedStatusException: Error hosting endpoint tf-fashion-mnist-2020-09-23-09-05-25-791: Failed. Reason: The role 'xyz' does not have BatchGetImage permission for the image: '520713654638.dkr.ecr.us-east-1.amazonaws.com/sagemaker-tensorflow-serving:1.12-cpu'.

Please help me to resolve this issue.

amazon-sagemaker tensorflow amazon-web-services deployment amazon-s3
2 Answers

Reason: The role 'xyz' does not have BatchGetImage permission for the image: '520713654638.dkr.ecr.us-east-1.amazonaws.com/sagemaker-tensorflow-serving:1.12-cpu'.

This error means that the IAM role "xyz" (you can find this in the IAM console) does not have permission to make the BatchGetImage API call in ECR (Elastic Container Registry, you can find this service in the ECS console).

You can find a number of example IAM policies you can use for the "xyz" role to grant it permission to perform the API call her: https://docs.aws.amazon.com/AmazonECR/latest/userguide/repository-policy-examples.html

To add a policy go to the IAM console, look for the "xyz" role, and either add an (inline) policy, or edit one of its existing policies (if it already has a policy that grants similar permissions it would make sense to add this permission in that policy).

user_11090

Instead of managing permissions by crafting a permission policy, you can use the AWS-managed AmazonSageMakerFullAccess permission policy, which allows for any actions you might want to perform in SageMaker (including BatchGetImage).

To do so:

  1. Log onto the console -> IAM -> Roles -> Create Role
  2. Create a service-linked role with sagemaker.amazonaws.com
  3. Give the role AmazonSageMakerFullAccess
  4. Give the role AmazonS3FullAccess
user_39030970
Related