Fixing S3 Write Permissions for SageMaker Training Jobs
A company uses Amazon SageMaker to train machine learning models. The data science team has developed a training script that uses TensorFlow. They want to run the training job on a GPU instance (ml.p3.2xlarge) and store the model artifact in Amazon S3. The training job completes successfully, but the model artifact is not saved to S3. The team has confirmed that the S3 bucket policy allows write access from the SageMaker execution role. The training script uses the TensorFlow estimator with the following configuration:
``` tensorflow_estimator = TensorFlow( entry_point='train.py', role='arn:aws:iam::123456789012:role/SageMakerExecutionRole', instance_count=1, instance_type='ml.p3.2xlarge', output_path='s3://my-bucket/output', framework_version='2.3', py_version='py37', ) ```
The train.py script saves the model using `model.save('/opt/ml/model')`. What is the MOST likely reason the model artifact is not being saved to S3?
Quick Answer
The answer is that the SageMaker execution role lacks the `s3:PutObject` permission for the S3 bucket. Even though the bucket policy allows write access from the role, the IAM role itself must explicitly grant the `s3:PutObject` action on the bucket—SageMaker evaluates both the identity-based policy (the role) and the resource-based policy (the bucket), and a missing permission on the role side will block the upload. On the AWS Certified Machine Learning Specialty MLS-C01 exam, this question tests your understanding of how SageMaker training jobs interact with S3: the framework automatically copies everything from `/opt/ml/model` to the `output_path` after training, so the script saving to the correct directory is not the issue. A common trap is assuming a permissive bucket policy is sufficient, but the execution role’s IAM policy is the primary gatekeeper. Memory tip: think “Role first, bucket second”—the role must have the write key before the bucket can unlock the door.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The SageMaker execution role does not have the s3:PutObject permission for the S3 bucket.
The training script correctly saves the model to /opt/ml/model, which is the default directory that SageMaker automatically uploads to the S3 output path at the end of training. Since the job completes successfully, the script ran without errors. The most likely cause is that the SageMaker execution role lacks the s3:PutObject permission on the S3 bucket. Although the bucket policy allows write access from the role, the role itself must have the appropriate IAM permission. Option B is correct. Option A is incorrect because saving to /opt/ml/model is correct. Option C is incorrect because output_path does not require a trailing slash and is correctly formatted. Option D is incorrect because TensorFlow estimator does not have a model_dir parameter that overrides the default; the default is /opt/ml/model.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The training script must save the model to /opt/ml/model/saved_model instead of /opt/ml/model.
Why it's wrong here
Wrong: Saving to /opt/ml/model is correct; SageMaker uploads the entire directory.
- ✓
The SageMaker execution role does not have the s3:PutObject permission for the S3 bucket.
Why this is correct
Correct: The role needs s3:PutObject to write to S3.
- ✗
The output_path parameter is incorrectly formatted; it should include a trailing slash.
Why it's wrong here
Wrong: The output_path format is correct; trailing slash is optional.
- ✗
The TensorFlow estimator requires the model_dir parameter to be set to the S3 output path.
Why it's wrong here
Wrong: model_dir is not a parameter of TensorFlow estimator; output_path is used.
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
One of 1,672 original MLS-C01 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on MLS-C01
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A company is using Amazon SageMaker to train a machine learning model. The training job is configured to use the File mode to download data from S3 to the training instances. The training data is stored in a single S3 bucket with multiple prefixes. Which TWO actions are required to ensure the training job can access the data? (Choose TWO.)
hard- ✓ A.Grant the SageMaker execution role s3:GetObject permission for the data bucket.
- B.Configure the training job to use Pipe mode.
- ✓ C.Specify the S3 data channel with the correct prefix.
- D.Concatenate all data files into a single file.
- E.Convert the data to RecordIO-protobuf format.
Why A: Options A and C are correct. Option A: The SageMaker execution role must have the s3:GetObject permission for the data bucket to read the training data. Option C: When using File mode, the training job must specify the S3 data channel with the correct prefix to indicate the location of the data. Option B is incorrect because Pipe mode is not required for File mode. Option D is incorrect because concatenating all data into a single file is unnecessary for File mode. Option E is incorrect because File mode does not require RecordIO-protobuf format.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This MLS-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the MLS-C01 exam.