"role=get_execution_role" throws region error

[purplexed]

Describe the bug
Using this sdk within a codebuild job, I run the get_execution_role and I get the following error:

Traceback (most recent call last):
--
341 | File "xxx/xxx.py", line 23, in <module>
342 | role = get_execution_role()
343 | File "/usr/local/lib/python3.7/site-packages/sagemaker/session.py", line 3293, in get_execution_role
344 | arn = sagemaker_session.get_caller_identity_arn()
345 | File "/usr/local/lib/python3.7/site-packages/sagemaker/session.py", line 2891, in get_caller_identity_arn
346 | endpoint_url=sts_regional_endpoint(self.boto_region_name),
347 | File "/usr/local/lib/python3.7/site-packages/botocore/client.py", line 357, in _api_call
348 | return self._make_api_call(operation_name, kwargs)
349 | File "/usr/local/lib/python3.7/site-packages/botocore/client.py", line 661, in _make_api_call
350 | raise error_class(parsed_response, operation_name)
351 | botocore.exceptions.ClientError: An error occurred (SignatureDoesNotMatch) when calling the GetCallerIdentity operation: Credential should be scoped to a valid region, not 'eu-west-1'.

This only happens in the latest 1.50.14 version of sagemaker. 1.50.13 works fine.

To reproduce

1. Create a codebuild job
2. The buildspec should firstly install the requirements.txt installation, which should include the sagemaker 1.50.14 package
3. The buildspec should run a python script that includes the following code:

from sagemaker import get_execution_role

role = get_execution_role()
print(role)

Expected behavior
Expected to get the sagemaker execution role for the notebook instance and run the script.

System information

• Python 3.7:
• sagemaker 1.50.14:

[laurenyu]

hi @purplexed, I tried running get_execution_role in a Notebook Instance and was unable to reproduce the error. You mentioned that you're using CodeBuild in this as well - could you describe your use case in a little more detail?

The get_execution_role method is intended for use only in SageMaker Notebook Instances. We have an outstanding issue to work on improving that: #300

[purplexed]

Hi @laurenyu, thanks for getting back!

I understand that the get_execution_role should be used in SageMaker Notebook instances, but I wouldn't want the data scientist bothered with the infrastructure side of things.

As for my use case, I use that command in a python script, which is being invoked by a codebuild job. Apologies for the initial lack of clarity. More specifically what I am trying to do and fails:

buildspec.yml

version: 0.2
phases:
  pre_build:
    commands:
      - pip install -r requirements.txt
  build:
    commands:
      - export VERSION=$(cat version.txt)
      - python sagemaker.py "${VERSION}"

sagemaker.py

from sagemaker import get_execution_role

modelName = xxx
s3_model_location = xxx
image_name = xxx
role = get_execution_role()
sess = sagemaker.Session()

model = sagemaker.model.Model ( name = modelName,
                                model_data = s3_model_location,
                                image = image_name,
                                role = role,
                                sagemaker_session = sess)

Let me know if there is anything more specific I could indicate.

[nadiaya]

As @laurenyu said get_execution_role() was never intended to work outside of SageMaker Notebook Instances.

Thank you so much for providing details about your use case. It will definitely help when #300 issue will get prioritized.

For running SageMaker in a codebuild job we could recommend doing something similar to what python-sdk does for integ tests and creating a "SageMakerRole" in the account you are running tests or by hardcoding the arn.

A few links about finding role that might be helpful:
https://docs.aws.amazon.com/cli/latest/reference/sts/get-caller-identity.html
https://stackoverflow.com/questions/47313778/find-role-being-used-on-server-from-aws-cli/52073848#52073848

Closing this issue in favor of #300.