Question

A data science team in Account A trains models and stores the resulting model artifacts in an S3 bucket in a shared Account B, which is encrypted with a customer managed KMS key owned by Account B. A SageMaker training job's execution role in Account A repeatedly fails to write artifacts, returning an AccessDenied error even though the S3 bucket policy grants the role s3:PutObject. What is the MOST likely cause and correct remediation?

Accepted Answer

The execution role lacks kms:Encrypt/GenerateDataKey permissions and the KMS key policy in Account B does not grant those actions to the Account A role; add both the IAM permissions and the KMS key policy grant.

Answer

SageMaker cannot write to cross-account buckets; copy the artifacts locally and use a Lambda function in Account B to upload them.

Answer

The training instance needs a VPC endpoint for S3; add an S3 gateway endpoint to the training job's subnet.

Answer

The S3 bucket must have versioning enabled before SageMaker can write encrypted objects; enable versioning on the Account B bucket.