title: aws sagemaker - IAM permission to call get_role
body: <h1>Question</h1>
  <p>In which AWS documentation explains the IAM permissions required to run SageMaker in a SageMaker Studio?</p>
  <h1>Problem</h1>
  <p>In a SageMaker Studio with an IAM policy <a href="https://console.aws.amazon.com/iam/home#/policies/arn:aws:iam::aws:policy/AmazonSageMakerFullAccess" rel="noreferrer">AmazonSageMakerFullAccess</a> attached.</p>
  <p>The AWS documentation <a href="https://docs.aws.amazon.com/sagemaker/latest/dg/security-iam-awsmanpol.html#security-iam-awsmanpol-AmazonSageMakerFullAccess" rel="noreferrer">AmazonSageMakerFullAccess</a>:</p>
  <blockquote>
  <p>This policy grants administrative permissions that allow a principal full access to all Amazon SageMaker resources and operations. <strong>The policy also provides select access to related services</strong>.<BR></p>
  <h3>Permissions details<BR></h3>
  <p>This policy includes the following permissions.<BR>
  ... <BR>
  iam – Needed to give the SageMaker console access to available IAM roles and create service-linked roles.</p>
  </blockquote>
  <p>However, run the code below as instructed <a href="https://docs.aws.amazon.com/sagemaker/latest/dg/sagemaker-roles.html" rel="noreferrer">SageMaker Roles</a> fails.</p>
  <pre><code>import sagemaker
  
  sess = sagemaker.Session()
  role = sagemaker.get_execution_role()
  -----
  Couldn't call 'get_role' to get Role ARN from role name &lt;IAM Role Name&gt; to get Role path.
  </code></pre>
  <p><a href="https://i.stack.imgur.com/QP8iG.png" rel="noreferrer"><img src="https://i.stack.imgur.com/QP8iG.png" alt="enter image description here" /></a></p>
  <h1>Fix</h1>
  <p>Attached <code>iam:GetRole</code> permission to solve the issue. However, where is it documented?</p>
  <p><a href="https://i.stack.imgur.com/Y6kPs.png" rel="noreferrer"><img src="https://i.stack.imgur.com/Y6kPs.png" alt="enter image description here" /></a></p>
  <h1>Related</h1>
  <p>Apparently AWS acknowledged this is an issue in 2020 and has not updated document?</p>
  <ul>
  <li><a href="https://github.com/aws/sagemaker-python-sdk/issues/2027#issuecomment-765870062" rel="noreferrer">AWS SageMaker Github This project requires more permissions than AmazonSageMakerFullAccess gives it #2027</a></li>
  </ul>
  <blockquote>
  <p>Well yeah I found a solution, but you should probably fix the underlying problem- either in the documentation or in your policies themselves.</p>
  </blockquote>