Why SageMaker Studio Project Creation Fails — And How to Fix It

Why SageMaker Studio Project Creation Fails — And How to Fix It

Problem

You're encountering the following error while trying to create a project in SageMaker Unified Studio:

Caller is not authorized to create environment using blueprintId

This indicates that the user or role attempting the action lacks the necessary IAM permissions to deploy a SageMaker environment using a specific blueprint.

Clarifying the Issue

From the screenshots, SageMaker is attempting to create a Project Environment—often labeled as “Tooling” or similar—but it fails due to insufficient IAM permissions. The environment blueprint (template) referenced requires elevated access to be deployed, and your assigned role doesn’t have those permissions granted yet.

Based on your IAM console screenshot, you have several roles in play, including:

• AmazonSageMaker-ExecutionRole-*
• AmazonSageMakerDomainExecution
• AWSReservedSSO_AdministratorAccess_*
  
  

The failure usually stems from using the Execution Role rather than the correct Domain Execution Role or not attaching the necessary SageMaker permissions to either.

Why It Matters

Without fixing this, you won’t be able to create new SageMaker Studio projects with certain templates. This halts experimentation, collaboration, or even model deployment if those blueprints are part of your workflow. It also blocks users from leveraging the automated tooling environments SageMaker Unified Studio is built to support.

Key Terms

• IAM Role: AWS identity with policies that determine what actions are allowed.
• Execution Role: Role assumed by SageMaker services to access AWS resources.
• Domain Execution Role: Special role SageMaker uses to create and manage Studio environments.
• Blueprint ID: Template for configuring a prebuilt Studio project (e.g., for MLOps, data science, etc.).

Steps at a Glance

1. Identify which IAM role SageMaker Studio is using.
2. Check that role's attached policies.
3. Attach the Required Managed Policies.
4. Add Blueprint Access if Needed.
5. Retry Project Creation.

Detailed Steps

1. Identify the Active Role

   • Go to the IAM console and check the Studio domain configuration:
     • Navigate to Amazon SageMaker > Studio > Domains
     • Click your domain
     • Look under “Execution Role” or “User Settings” for the IAM role in use

2. Confirm It’s the AmazonSageMakerDomainExecution Role

   • This is the one SageMaker Unified Studio typically needs for project creation. The AmazonSageMaker-ExecutionRole-* is usually for notebooks or processing jobs—not project environment creation.

3. Attach the Required Managed Policies

   • To fix the error, add the following policies to the Domain Execution Role:
     • AmazonSageMakerFullAccess (if experimenting or learning)
     • Or more narrowly scoped policies like:
       • sagemaker:CreateApp
       • sagemaker:CreateProject
       • sagemaker:CreateDomain
       • sagemaker:CreateUserProfile
       • sagemaker:CreateStudioLifecycleConfig

4. Add Blueprint Access if Needed

   • If the blueprint uses AWS Service Catalog or custom VPC configurations, you may also need:
     • servicecatalog:ListLaunchPaths
     • servicecatalog:DescribeProduct
     • iam:PassRole (for launching with roles)

5. Retry Project Creation

   • Once the policies are added, go back to Studio and recreate the project. If the permissions are correct, the tooling environment should deploy successfully.

Conclusion

The error you’re seeing isn’t a bug—it’s a classic IAM permissions issue. SageMaker Studio is trying to automate a lot of infrastructure with each project, and that requires broader permissions than an execution role alone typically provides. By ensuring the Domain Execution Role has the right access, especially around blueprint deployment, you'll unlock the full power of SageMaker Studio's project tooling. 🔧🚀

Need AWS Expertise?

If you're looking for guidance on AWS or any cloud challenges, feel free to reach out! We'd love to help you tackle AWS projects. 🚀

Email us at: info@pacificw.com

Image: Gemini