search

aws-samples / amazon-bedrock-workshop

This is a workshop designed for Amazon Bedrock a foundational model service.
https://catalog.us-east-1.prod.workshops.aws/amazon-bedrock/en-US
MIT No Attribution
1.49k stars 639 forks source link

How to resolve Authorizations errors when running lab 03_QuestionAnswering/02_qa_w_rag_claude_opensearch #189

Open GAcharyaOS opened 9 months ago

GAcharyaOS commented 9 months ago

When running this lab, you will encounter permissions error in the following steps :

  1. The cell trying to create vector store using Opensearch serverless
  2. Step / cell to inject the documents into vector store.
  3. Clean-up step

To resolve permission issue # 1 and # 3 above, attach following inline policy to the IAM SageMaker execution role you used to launch the SageMaker studio and re-run the cells.

{ "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "aoss:CreateSecurityPolicy", "aoss:UpdateSecurityPolicy", "aoss:CreateCollection", "aoss:ListCollections", "aoss:CreateAccessPolicy", "aoss:APIAccessAll", "aoss:DeleteSecurityPolicy", "aoss:DeleteCollection", "aoss:DeleteAccessPolicy" ], "Resource": "" }, { "Effect": "Allow", "Action": "iam:CreateServiceLinkedRole", "Resource": "arn:aws:iam:::role/aws-service-role/observability.aoss.amazonaws.com/AWSServiceRoleForAmazonOpenSearchServerless" } ] }

The permission error in the # 2 above ("Step / cell to inject the documents into vector store. ") is more of a sporadic and timing issue. It is caused because its executed before the index creation is completed in the OpenSearch cluster. Re-run this after a min or two delay, and it should run without error.

w601sxs commented 7 months ago

will test - cc: @mani-aiml

w601sxs commented 6 months ago

I think this should be fixed by now, can you confirm @mani-aiml