Cross-Account S3 Access for SageMaker Training
A company is using Amazon SageMaker to train a model with a custom algorithm. The training script reads data from an S3 bucket using boto3. The training job fails with an 'AccessDenied' error when trying to access the S3 bucket. The IAM role attached to the SageMaker notebook instance has full S3 access. What is the most likely cause?
Quick Answer
The key concept here is that a SageMaker notebook instance and a SageMaker training job are two separate compute contexts, each running under its own IAM role, and permissions granted to one do not automatically extend to the other. The notebook instance's IAM role governs what the interactive development environment can do, browsing S3, testing code, and so on, but when a training job is launched, SageMaker spins up separate, managed training infrastructure that assumes a distinct execution role specified for that job, not the notebook's role. If that training job execution role hasn't been granted the necessary S3 permissions, such as s3:GetObject or s3:ListBucket, the training script's boto3 calls to read data will fail with Access Denied, even though the notebook environment that submitted the job has full S3 access. This is a common trap because it's easy to assume that broad permissions on the role you're actively working in cover everything the resources you launch will need, when in fact each SageMaker compute resource can be configured with its own execution role and its own permission boundary. The fix is to ensure the training job's execution role itself, not just the notebook's role, has the S3 permissions the training script requires. Whenever a scenario shows a notebook with ample permissions but a training job (or any other launched SageMaker resource) failing with Access Denied, check the execution role assigned specifically to that resource rather than assuming the notebook's role applies.
⚠ Common exam trap
A common mix-up: candidates confuse the IAM role attached to the SageMaker notebook instance with the execution role used by the training job, assuming they are the same or that permissions propagate automatically.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The SageMaker execution role used for the training job does not have S3 access permissions.
The IAM role attached to the SageMaker notebook instance is used for interactive development, but training jobs run under a separate SageMaker execution role. Even if the notebook role has full S3 access, the training job's execution role must also have explicit S3 permissions. The 'AccessDenied' error indicates that the execution role lacks the necessary s3:GetObject or s3:ListBucket actions for the S3 bucket.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The S3 bucket has a bucket policy that denies access from the SageMaker service.
Why it's wrong here
While possible, the error is more commonly due to missing execution role permissions.
- ✓
The SageMaker execution role used for the training job does not have S3 access permissions.
Why this is correct
The training job uses its own execution role, which must be granted S3 access.
- ✗
The training script is using an incorrect S3 bucket name.
Why it's wrong here
A wrong bucket name would cause a NoSuchBucket error, not AccessDenied.
- ✗
The SageMaker training job is not configured to use the S3 VPC endpoint.
Why it's wrong here
S3 access via VPC endpoint does not require IAM changes; the endpoint itself does not grant permissions.
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
Courseiva writes every MLS-C01 question from scratch — 1,672 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
2 more ways this is tested on MLS-C01
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A company is using Amazon SageMaker to train a model on data stored in S3. The training job needs to access data from an S3 bucket in a different AWS account. The data owner has granted cross-account access via a bucket policy. However, the training job fails with an AccessDenied error. What is the MOST likely cause?
hard- A.The data is encrypted with SSE-KMS and the SageMaker role lacks KMS permissions.
- ✓ B.The SageMaker execution role does not have the necessary permissions to access the S3 bucket.
- C.The S3 bucket is not configured with public access.
- D.The S3 bucket is in a different region and requires a VPC endpoint.
Why B: Even with a bucket policy granting cross-account access, the SageMaker execution role must have an IAM policy that allows s3:GetObject (and any other required actions) on the S3 bucket. Without these permissions, the training job will fail with AccessDenied. Option A is incorrect because SSE-KMS encryption would require KMS permissions, but the issue is specifically about access permissions, not encryption. Option C is incorrect because the data does not need to be public; cross-account access via bucket policy is sufficient. Option D is incorrect because cross-account access does not require a VPC endpoint.
Variation 2. A company is using Amazon SageMaker to train a model. The training data is stored in an S3 bucket in a different AWS account. Which IAM policy configuration is required to allow SageMaker to access the data?
easy- A.Add a bucket policy that allows s3:GetObject for the SageMaker execution role's ARN.
- ✓ B.Add a bucket policy allowing access from the SageMaker execution role ARN, and ensure the SageMaker execution role has an IAM policy allowing s3:GetObject on the bucket.
- C.Create an IAM user in the data owner's account and use its credentials in SageMaker.
- D.Use the data owner's IAM role as the SageMaker execution role.
Why B: Cross-account access requires the SageMaker execution role to have an IAM policy allowing access to the S3 bucket, and the S3 bucket policy must grant access to that role. Option A is wrong because SageMaker cannot assume a role in another account without proper trust policy. Option C is wrong because the data owner's role cannot be used directly. Option D is wrong because SageMaker does not use the data owner's IAM user credentials.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This MLS-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the MLS-C01 exam.