Getting: Error hosting endpoint, role doesn't have BatchGetImage where acctually role has it

[rima317]

trafficstars

Hi, I'm getting: UnexpectedStatusException: Error hosting endpoint huggingface-pytorch-inference-2023-06-01-15-13-58-275: Failed. Reason: The role 'arn:aws:iam::MY_ACCOUNT:role/MyTestRole' does not have BatchGetImage permission for the image: '[763104351884.dkr.ecr.us-east-1.amazonaws.com/huggingface-pytorch-inference@sha256:e535539e2c3ca213d59fb07b2c9c972d0a83129622674e42c21cca5ae90621aa'](http://763104351884.dkr.ecr.us-east-1.amazonaws.com/huggingface-pytorch-inference@sha256:e535539e2c3ca213d59fb07b2c9c972d0a83129622674e42c21cca5ae90621aa')..

For the example in: https://github.com/huggingface/notebooks/blob/main/sagemaker/11_deploy_model_from_hf_hub/deploy_transformer_model_from_hf_hub.ipynb

Where I've added to MyTestRole permission to BatchGetImage like:

    {
        "Effect": "Allow",
        "Action": [
            "ecr:ListTagsForResource",
            "ecr:ListImages",
            "ecr:DescribeRepositories",
            "ecr:BatchCheckLayerAvailability",
            "ecr:GetLifecyclePolicy",
            "ecr:DescribeImageScanFindings",
            "ecr:GetLifecyclePolicyPreview",
            "ecr:GetDownloadUrlForLayer",
            "ecr:BatchGetImage",
            "ecr:DescribeImages",
            "ecr:GetRepositoryPolicy"
        ],
        "Resource": "arn:aws:ecr:us-east-1:*:repository/*"
    }

Using the Policy simulator it seems that this role can perform BatchGetImage action Ideas?