title: How do I make this IAM role error in aws sagemaker go away?
body: <p>I suspect this has to more to do with IAM roles than Sagemaker.</p>
  
  <p>I'm following the example <a href="https://github.com/aws/sagemaker-python-sdk/blob/master/src/sagemaker/tensorflow/README.rst" rel="noreferrer">here</a></p>
  
  <p>Specifically, when it makes this call</p>
  
  <pre><code>tf_estimator.fit('s3://bucket/path/to/training/data')
  </code></pre>
  
  <p>I get this error</p>
  
  <pre><code>ClientError: An error occurred (AccessDenied) when calling the GetRole operation: User: arn:aws:sts::013772784144:assumed-role/AmazonSageMaker-ExecutionRole-20181022T195630/SageMaker is not authorized to perform: iam:GetRole on resource: role SageMakerRole
  </code></pre>
  
  <p>My notebook instance has an IAM role attached to it.
  That role has the <code>AmazonSageMakerFullAccess</code> policy. It also has a custom policy that looks like this</p>
  
  <pre><code>{
  "Version": "2012-10-17",
  "Statement": [
      {
          "Effect": "Allow",
          "Action": [
              "s3:GetObject",
              "s3:PutObject",
              "s3:DeleteObject",
              "s3:ListBucket"
          ],
          "Resource": [
              "arn:aws:s3:::*"
          ]
      }
  ]
  </code></pre>
  
  <p>}</p>
  
  <p>My input files and .py script is in an s3 bucket with the phrase <code>sagemaker</code> in it.</p>
  
  <p>What else am I missing?</p>