Question

A data science team launches a SageMaker training job that reads a dataset from an S3 bucket encrypted with a customer managed KMS key. The training job runs under a dedicated SageMaker execution role that already has s3:GetObject permission on the bucket. However, the job fails immediately with an AccessDenied error when attempting to read the objects. What is the MOST likely cause and correct remediation?

Accepted Answer

The SageMaker execution role lacks kms:Decrypt permission on the customer managed key; grant the role decrypt access via the KMS key policy or an IAM policy.

Answer

The S3 bucket policy is missing s3:ListBucket; add it so SageMaker can enumerate objects before reading them.

Answer

The training instance is not deployed in a VPC; enable VPC mode so it can reach the KMS endpoint.

Answer

The KMS key must be rotated because automatic key rotation was disabled; enable rotation to restore access.