An application role receives AccessDenied on sagemaker:InvokeEndpoint (VPC and KMS look fine). What should they debug?
Select an answer to reveal the explanation.
Short Explanation
An application role gets AccessDenied on InvokeEndpoint, and VPC and KMS look fine. Debug the IAM, bucket-policy, or KMS-grant miss with the error and CloudTrail. Opening the security group to the world is not the fix.
Full Explanation
AccessDenied on InvokeEndpoint (or on s3:GetObject for model.tar.gz) is an IAM, bucket-policy, or KMS-grant miss. CloudTrail and the error name the missing allow. Opening the security group to the world is not the fix. Textract and retraining do not grant the API.