How do I troubleshoot connection errors when I set up input data for a SageMaker AI Ground Truth labeling job?

Short description 

If you have connection issues with SageMaker AI Ground Truth, then you receive an error similar to the following:

"Connection error: There was an issue with your input data setup. Ground Truth could not setup a connection with your dataset in S3. Please check your input data setup and try again, or use the manual data setup option. Network Failure Request id: <request_id> "

This error occurs because you don't have the necessary permissions or policies to set up the input data. To resolve the issue, this error, add the required policies. 

Resolution

SageMaker AI access

Attach the AmazonSageMakerFullAccess policy to your your AWS Identity and Access Management (IAM) role. Then, specify the following SageMaker AI Ground Truth actions in the policy:

• groundtruthlabeling:DescribeConsoleJob
• groundtruthlabeling:ListDatasetObjects
• groundtruthlabeling:RunFilterOrSampleDatasetJob
• groundtruthlabeling:RunGenerateManifestByCrawlingJob

For more information, see Actions defined by Amazon GroundTruth Labeling.

Amazon S3 access

Add Amazon Simple Storage Service (Amazon S3) read and write permissions to access the input data files to your IAM role. For more information, see Grant read and write access to Amazon S3 bucket objects.

cross-account access

If your data is in another AWS account, then check that the execution role account has access to the S3 objects. For more information, see How do I grant cross-account access to objects that are in Amazon S3 buckets?

Service control policies

Make sure that the AWS Organizations service control policies (SCPs) that you applied at the organization level don't restrict actions on the member account. For example, even if the execution role has the required permissions, an explicit DENY on all groundtruthlabeling actions overrides the permissions and restricts the connection.

For more information, see SCP effects on permissions.