AWS marketplace documentation change
Summary
Restructured troubleshooting guide with expanded error resolution details. Added sections for 400/404 errors, access denied issues, and ECR scan failures. Clarified IAM permission requirements and cross-account resource handling.
Security assessment
Added documentation about required IAM permissions (sagemaker:DescribeModelPackage/Algorithm) and cross-account ECR image restrictions, which are security best practices. However, there's no mention of addressing specific vulnerabilities or exploits.
Diff
diff --git a/marketplace/latest/userguide/ml-troubleshooting.md b/marketplace/latest/userguide/ml-troubleshooting.md index 52a8d09ef..eb8cd199b 100644 --- a/marketplace/latest/userguide/ml-troubleshooting.md +++ b/marketplace/latest/userguide/ml-troubleshooting.md @@ -5 +5,3 @@ -# Troubleshooting errors for machine learning product publishing +400 error when adding product ARN404 error when adding product ARNSageMaker AI access denied error when creating productSageMaker AI failure when creating product + +# Troubleshooting issues with machine learning products @@ -9 +11,7 @@ This section provides help for some common errors that you might encounter durin -**General: I get a 400 error when I add the Amazon Resource Name (ARN) of my model package or algorithm in the AWS Marketplace Management Portal** +## General: I get a 400 error when I add the Amazon Resource Name (ARN) of my model package or algorithm in the AWS Marketplace Management Portal + +### Common cause + +When creating your machine learning product in SageMaker AI, you didn't choose to publish your product in AWS Marketplace. + +### Resolution @@ -17 +25,3 @@ After you re-create your certified and validated model package or algorithm reso -**General: I get a 404 error when I add the ARN of my model package or algorithm in the AWS Marketplace Management Portal** +## General: I get a 404 error when I add the ARN of my model package or algorithm in the AWS Marketplace Management Portal + +### Common cause @@ -21 +31,20 @@ This error can happen for several reasons: - * The ARN might be invalid. Ensure that you are using the correct ARN. + * The ARN might be invalid. + + * The model package or algorithm resource wasn't created in the same AWS account as the seller account. + + * The user or role that you use for publishing doesn't have the correct IAM permissions to access the model package or algorithm resource. + + + + +### Resolution + + 1. Check the ARN to ensure it is the correct ARN and is in the expected format: + +For model packages, the ARNs should look similar to `arn:aws:sagemaker:us-east-2:000123456789:model-package/my-model-package-name`. + +For algorithms, the ARNs should look similar to `arn:aws:sagemaker:us-east-2:000123456789:algorithm/my-algorithm`. + + 2. Ensure that all resources and assets for publishing are in the seller account that you are publishing from. + + 3. Ensure that your user or role has the following permissions: @@ -23 +52 @@ This error can happen for several reasons: - * For model packages, the ARNs should look similar to `arn:aws:sagemaker:us-east-2:000123456789:model-package/my-model-package-name`. +For model packages, the action `sagemaker:DescribeModelPackage` on the model package resource must be allowed. @@ -25 +54 @@ This error can happen for several reasons: - * For algorithms, the ARNs should look similar to `arn:aws:sagemaker:us-east-2:000123456789:algorithm/my-algorithm`. +For algorithms, the action `sagemaker:DescribeAlgorithm` on the algorithm resource must be allowed. @@ -27 +55,0 @@ This error can happen for several reasons: - * The model package or algorithm resource wasn't created in the same AWS account as the seller account. Ensure that all resources and assets for publishing are in the seller account that you are publishing from. @@ -29 +56,0 @@ This error can happen for several reasons: - * The user or role that you use for publishing doesn't have the correct IAM permissions to access the model package or algorithm resource. Ensure that your user or role has the following permissions: @@ -31 +57,0 @@ This error can happen for several reasons: - * For model packages, the action `sagemaker:DescribeModelPackage` on the model package resource must be allowed. @@ -33 +59 @@ This error can happen for several reasons: - * For algorithms, the action `sagemaker:DescribeAlgorithm` on the algorithm resource must be allowed. +## Amazon SageMaker AI: I get a “Client error: Access denied for registry” failure message when I create a model package or algorithm resource @@ -34,0 +61 @@ This error can happen for several reasons: +### Common cause @@ -35,0 +63 @@ This error can happen for several reasons: +This error can happen when the image that is being used to create the model package or algorithm is stored in an [Amazon ECR](https://aws.amazon.com/ecr/) repository that belongs to another AWS account. Model package or algorithm validation does not support cross-account images. @@ -36,0 +65 @@ This error can happen for several reasons: +### Resolution @@ -38 +67 @@ This error can happen for several reasons: -**General: I get a 500 error when I specify the pricing for my algorithm product in the AWS Marketplace Management Portal** +Copy the image to an Amazon ECR repository owned by the AWS account that you are using to publish. Then, proceed with creating the resource using the new image location. @@ -40 +69 @@ This error can happen for several reasons: -This error can happen when you attempt to publish an algorithm resource with only a training image and without an accompanying inference image. Algorithm resources that are published on AWS Marketplace must have both components. For more information, see [Preparing your product in SageMaker AI](./ml-prepare-your-product-in-sagemaker.html). +## Amazon SageMaker AI: I get “Not Started” and “Client error: No scan scheduled...” failure messages when I create a model package or algorithm resource @@ -42 +71 @@ This error can happen when you attempt to publish an algorithm resource with onl -**Amazon SageMaker AI: I get a “Client error: Access denied for registry” failure message when I create a model package or algorithm resource** +### Common cause @@ -44 +73 @@ This error can happen when you attempt to publish an algorithm resource with onl -This error can happen when the image that is being used to create the model package or algorithm is stored in an [Amazon ECR](https://aws.amazon.com/ecr/) repository that belongs to another AWS account. Model package or algorithm validation does not support cross-account images. Copy the image to an Amazon ECR repository owned by the AWS account that you are using to publish. Then, proceed with creating the resource using the new image location. +This error can happen when SageMaker AI fails to start a scan of your Docker container image stored in Amazon ECR. @@ -46 +75 @@ This error can happen when the image that is being used to create the model pack -**Amazon SageMaker AI: I get “Not Started” and “Client error: No scan scheduled...” failure messages when I create a model package or algorithm resource** +### Resolution @@ -48 +77 @@ This error can happen when the image that is being used to create the model pack -This error can happen when SageMaker AI fails to start a scan of your Docker container image stored in Amazon ECR. If this happens, open the [ Amazon ECR console](https://console.aws.amazon.com/ecr/repositories?region=us-east-2), find the repository where your image was uploaded to, choose the image, and then choose **Scan**. +If this happens, open the [ Amazon ECR console](https://console.aws.amazon.com/ecr/repositories?region=us-east-2), find the repository where your image was uploaded to, choose the image, and then choose **Scan**. @@ -56 +85 @@ To use the Amazon Web Services Documentation, Javascript must be enabled. Please -Service restrictions and quotas +Requirements and best practices @@ -58 +87 @@ Service restrictions and quotas -Machine learning reports in AWS Marketplace +SaaS products