Back to all discussions

  •   7 months ago

Endpoint is restricted

Failed to deploy endpoint
User: arn:aws:sts::assumed-role/AmazonSageMaker-ExecutionRole-20251031T230062/SageMaker is not authorized to perform: sagemaker:CreateEndpointConfig on resource: arn:aws:sagemaker:us-east-1::endpoint-config/sagemaker-epc-1761966610998 with an explicit deny in a service control policy

  • 6 comments

  •   •   7 months ago

    Hi Riddhi,

    I believe NVIDIA x AWS team subscribed all users to these two models: Llama 3.1 Nemotron Nano 8B V1 (LLM) and Llama-3.2-NV-EmbedQA-1B-v2 (Embedding). Can you go to marketplace and check if it says you're already subscribed to those models? If you are not subscribed, you can either try deploying on EKS (which you only going to need an NVIDIA API key) or email Sara so she can let the team know your account is still not subscribed.

    Link to the marketplace for Nemotron Nano 8B: https://aws.amazon.com/marketplace/pp/prodview-6wde2hzvft7y4?sr=0-2&ref_=beagle&applicationId=AWSMPContessa

    Link to how to deploy on EKS (I personally followed this and was able to successfully run the LLM): https://github.com/NVIDIA/nim-deploy/blob/main/cloud-service-providers/aws/workshops/nim-on-eks/index.en.md

    (in the EKS guide you would only have to change the repository in task 2 part 6 to "nvcr.io/nim/nvidia/llama-3.1-nemotron-nano-8b-v1" and its tag to "latest")

  •   •   7 months ago

    I get a similar message and that's either because: You don't have credits or have ran out of credits.
    Being subscribed is different than being able to deploy. Deployment requires credits to begin with.
    Did you submit a request for the $100 credit? If not, you won't be able to deploy your model.
    - The amount of credits available is displayed at your nvidia.vocareum homepage.
    - The usage gets updated (guessing) every few hours or may be every 24 hours (not sure), so be mindful of this.

  •   •   7 months ago

    Yes, I requested for $100 credit and I was given but it never showed in my account and this was first time using, So i didn't exhaust the credits.

  •   •   7 months ago

    It looks like they took the credits back from those who were not active during the past week which is unfortunate. My remaining $97 credit disappeared and I am mostly sure I never used more than $3 of it.
    Asked this yesterday, but not expecting any answers during the weekend. Good luck!

  •   •   6 months ago

    Riddhi, my credit shows 0 as well and I have no problem setting up an EKS cluster.

    About the permission to use models, if your vocareum account has been recently instantiated, i know of people who have the same problem, and didn't get the access to the model. However, if you go down the EKS route, you won't need amazon permission to use a model (which is what you're missing in the first error message --> an explicit deny in a service control policy).

    If you choose to deploy on EKS, you need to have NVIDIA API key. Which might be restricted to certain countries. So, I recommend to first try and see if you can signup and get an nvidia API key from build.nvidia.com. And if you do have that key, you shouldn't have any problem setting up the EKS with your NIM model

  •   •   6 months ago

    Borna, Yes from your first message, I followed the EKS document and was able to get the endpoint thereafter complete the deployment. EKS was very easy and straightforward, so thank you for pointing in that direction.

Comments are closed.