SageMaker fails to create sagemaker_data_wrangler database cause Lake Formation permissions

Viewed 211

The Glue DataCatalog access is managed by Lake Formation. But when trying to add a new SageMaker Data Wrangler flow that queries an Athena table, it gives the following error:

CustomerError: An error occurred when trying to create sagemaker_data_wrangler database in the Glue data catalog: An error occurred (AccessDeniedException) when calling the CreateDatabase operation: Insufficient Lake Formation permission(s): Required Create Database on Catalog

The database sagemaker_data_wrangler does not exist, but we have add the default S3 bucket that uses SageMaker (sagemaker-{region}-{account}), to Lake Formation Data Location, in order to give the SageMaker execution role CreateDatabase privileges:

Lake Formation Data Location

The error persists even if we manually create the database (sagemaker_data_wrangler) and give privileges to the Data Wrangler execution role.

1 Answers

Solved.

It was missing the CreateDatabase privilege to the Catalog, which must be given through AWS CLI cause the AWS Console does not give the option:

aws lakeformation grant-permissions --principal DataLakePrincipalIdentifier=arn:aws:iam::10223*******:role/sandbox-******-mlops-demo-sagemaker --permissions "CREATE_DATABASE" --resource '{ "Catalog": {}}'
Related