'BatchGetImage permission' error when deploying SageMaker endpoint by using Tensorflow base image

[lu-liu-rft]

I have a pre-trained Tensorflow model, I'm trying to using SagaMaker client.create_endpoint() to create an endpoint so that I can call the API to get predictions, the doc is [here][1]

After creating the model by using client.create_model() I have a model stored on SageMaker, and the base image I'm using is xxxxxxx.dkr.ecr.us-east-1.amazonaws.com/tensorflow-inference:1.15.2-gpu
[1]: https://boto3.amazonaws.com/v1/documentation/api/latest/reference/services/sagemaker.html#SageMaker.Client.create_endpoint

After running this, I'm able to create the endpoint configuration, but it failed to create the endpoint, reason:

Failure reason
The role 'arn:aws:iam::xxxxxxxxxxx:role/test-role' does not have BatchGetImage permission for the image: 'xxxxxxx.dkr.ecr.us-east-1.amazonaws.com/tensorflow-inference:1.15.2-gpu'.

In the policy of this role, I have:

{
            "Sid": "VisualEditor3",
            "Effect": "Allow",
            "Action": [
                "ecr:BatchGetImage"
            ],
            "Resource": [
                "arn:aws:ecr:us-east-1:xxx:repository/*sagemaker*"
            ]
        },

        {
            "Sid": "VisualEditor2",
            "Effect": "Allow",
            "Action": [
                "ecr:BatchDeleteImage",
                "ecr:UploadLayerPart",
                "ecr:DeleteRepository",
                "ecr:PutImage",
                "ecr:SetRepositoryPolicy",
                "ecr:BatchGetImage",
                "ecr:CompleteLayerUpload",
                "ecr:DeleteRepositoryPolicy",
                "ecr:InitiateLayerUpload"
            ],
            "Resource": [
                "arn:aws:ecr:*:*:repository/*sagemaker*"
 ]
        }
....

I don't know what I'm missing here, I'm new to SageMaker, and I couldn't find any related docs about how to setup the right rpolicies, can someone take a look and give me some guidance please? Many thanks!

[HarjeetSinghGoldy]

Am getting the same issue could you please tell me how you resolve it. Thanks

[lu-liu-rft]

Am getting the same issue could you please tell me how you resolve it. Thanks

Hi, the following permissions work for me:

{
            "Effect": "Allow",
            "Action": "iam:PassRole",
            "Resource": "*",
            "Condition": {
                "StringEquals": {
                    "iam:PassedToService": [
                        "sagemaker.amazonaws.com",
                    ]
                }
            }
        },
        {
            "Effect": "Allow",
            "Action": [
                "ecr:ListTagsForResource",
                "ecr:ListImages",
                "ecr:DescribeRepositories",
                "ecr:BatchCheckLayerAvailability",
                "ecr:GetLifecyclePolicy",
                "ecr:DescribeImageScanFindings",
                "ecr:GetLifecyclePolicyPreview",
                "ecr:GetDownloadUrlForLayer",
                "ecr:BatchGetImage",
                "ecr:DescribeImages",
                "ecr:GetRepositoryPolicy"
            ],
            "Resource": [
                "arn:aws:ecr:us-east-1:*:repository/*"
            ]
        }