validation exception while featuregroup creation through sagemaker in ec2 - amazon-web-services

Question

I am referring to document https://sagemaker-examples.readthedocs.io/en/latest/sagemaker-featurestore/sagemaker_featurestore_fraud_detection_python_sdk.html#Ingest-Data-into-FeatureStore to create featuregroup in ec2 instance.
getting below error while executing the script.
An error occurred (ValidationException) when calling the CreateFeatureGroup operation: The execution role ARN is invalid. Please ensure that the role exists and that its trust relationship policy allows the action 'sts:AssumeRole' for the service principal 'sagemaker.amazonaws.com'.
I have confusion regarding roles here.
In above script, get_execution_role() is returning ec2-role-123 which is attached to ec2 instance and has trust policy as "ec2.amazonaws.com".Also this ec2 role I am passing to other role sync-role-123 which has both "ec2.amazonaws.com", "sagemaker.amazonaws.com" as trusted entities. I have attached below permission to ec2 role
{
"Sid": "AllowIAMPassRoleAccess",
"Effect": "Allow",
"Action": [
"iam:PassRole"
],
"Resource": "arn:aws:iam::1212121:role/sync-role-123"
}
now my confusion is since we are running script inside EC2 does it uses ec2-role-123 as execution role for both ec2 and sagemaker as well
OR
ec2-role-123 execution role will be passed to sync-role-123 for sagemaker API calls?
I am not getting clear understanding on how sagemaker API works specially inside EC2?
can someone please guide.
so that I can apply the fix accordingly.

Answer 1

If you are using the get_execution_role() this will return the role attached to the ec2 instance and the same will be used with SageMaker API for feature store. You can fix it in 2 ways
Attach the below permissions under trust_relationship for your ec2_role_123 ( attached to your ec2 instance) {
"Effect": "Allow",
"Principal": {
"Service": "sagemaker.amazonaws.com"
},
"Action": "sts:AssumeRole"
}
You can directly put a role arn for your sync-role-123 instead of the get_execution_role()and make sure sync-role-123 has necessary permissions.