Why SageMaker Training Needs s3:ListBucket Permission
Exhibit
Refer to the exhibit.
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": [
"s3:PutObject",
"s3:GetObject"
],
"Resource": "arn:aws:s3:::my-bucket/output/*"
},
{
"Effect": "Allow",
"Action": "iam:PassRole",
"Resource": "arn:aws:iam::123456789012:role/SageMakerRole"
}
]
}A data scientist is setting up a SageMaker training job and has attached this IAM policy to the execution role. The training job fails with an access denied error when trying to write to the output path 's3://my-bucket/output/model.tar.gz'. What additional permission is needed?
Quick Answer
The answer is s3:ListBucket. This permission is required because SageMaker training must verify that the output S3 bucket exists before it can write the model artifact; the s3:PutObject action alone is insufficient, as the service first performs a list operation to confirm the bucket’s existence and accessibility. On the AWS Certified Machine Learning Specialty MLS-C01 exam, this scenario tests your understanding of how SageMaker interacts with S3 during training job setup—a common trap is assuming only write permissions are needed, but the service’s internal validation step demands read-level access to the bucket. Remember that SageMaker treats the output path as a destination it must first discover, not just write to. A useful memory tip: “List before you Put” — SageMaker lists the bucket to confirm it exists before putting any object, so always include s3:ListBucket on the bucket resource when granting write access for training jobs.
⚠ Common exam trap
Test-takers frequently assume only s3:PutObject is needed for writing to S3, but AWS services like SageMaker often require s3:ListBucket to verify the bucket exists before performing write operations.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
s3:ListBucket
The training job fails because SageMaker needs to verify that the output S3 bucket exists before writing to it. The s3:ListBucket permission is required to list the contents of the bucket (or confirm its existence) as part of the write operation. Without this permission, the service cannot validate the bucket, resulting in an access denied error even if s3:PutObject is allowed.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
s3:ListBucket
Why this is correct
SageMaker requires ListBucket permission to access the bucket.
- ✗
s3:GetObject for the output path
Why it's wrong here
GetObject is already allowed.
- ✗
s3:DeleteObject
Why it's wrong here
Not needed for writing.
- ✗
iam:PassRole on the role itself
Why it's wrong here
Already allowed.
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
Courseiva writes every MLS-C01 question from scratch — 1,672 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on MLS-C01
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A data scientist has this IAM policy attached to an IAM role used by SageMaker. When trying to create a training job, the scientist gets an access denied error. The training data is in 's3://my-bucket/training-data/'. What is the most likely cause?
easy- A.The bucket name is misspelled
- B.The S3 resource ARN is incorrect
- ✓ C.Missing s3:ListBucket permission
- D.The sagemaker:CreateTrainingJob action is not allowed
Why C: The error occurs because the IAM policy grants s3:GetObject permission on the training data objects but lacks s3:ListBucket permission on the bucket itself. SageMaker's CreateTrainingJob API first performs a ListBucket call to verify the bucket exists and to enumerate objects, even if the exact object key is known. Without s3:ListBucket, the ListBucket call fails, resulting in an access denied error.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This MLS-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the MLS-C01 exam.