MLS-C01 Practice Question: Machine Learning Implementation and Operations

Exhibit

Refer to the exhibit.

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "sagemaker:CreateTrainingJob",
        "sagemaker:CreateModel",
        "sagemaker:CreateEndpointConfig",
        "sagemaker:CreateEndpoint"
      ],
      "Resource": "*"
    },
    {
      "Effect": "Allow",
      "Action": [
        "s3:GetObject",
        "s3:PutObject"
      ],
      "Resource": "arn:aws:s3:::company-bucket/*"
    }
  ]
}

An IAM policy is attached to a SageMaker execution role. A data scientist tries to create a training job using a custom algorithm stored in an ECR repository. The training job fails with an 'AccessDenied' error when pulling the Docker image from ECR. What is the missing permission?

⚠ Common exam trap

Watch out — candidates often confuse ECR pull permissions with S3 permissions (option C) or assume that the SageMaker CreateTrainingJob permission (option D) implicitly covers the ECR pull, when in fact the IAM role must explicitly grant the specific ECR read actions for image retrieval.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

ecr:GetDownloadUrlForLayer and ecr:BatchGetImage on the ECR repository

When SageMaker pulls a custom Docker image from ECR during training job creation, the execution role needs permissions to download the image layers. The required actions are ecr:GetDownloadUrlForLayer (to generate pre-signed URLs for each layer) and ecr:BatchGetImage (to retrieve image metadata and layer manifests). Without these, the 'AccessDenied' error occurs because SageMaker cannot authenticate or fetch the container image from the ECR repository.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✓
ecr:GetDownloadUrlForLayer and ecr:BatchGetImage on the ECR repository
Why this is correct
These permissions are required to pull a Docker image from ECR.
✗
ecr:PutImage on the ECR repository
Why it's wrong here
PutImage is for pushing, not pulling images.
✗
s3:GetObject on the ECR repository
Why it's wrong here
ECR is not S3.
✗
sagemaker:CreateTrainingJob on the ECR resource
Why it's wrong here
CreateTrainingJob is for the SageMaker API, not ECR.

Go deeper

MLS-C01 Practice Question: Machine Learning Implementation and Operations

Exhibit

Why each option matters

Option-by-option breakdown

Related to this question