title: Sagemaker xgb.fit resulting in error: "User XXX is not authorized to perform: iam.GetRole on resource: role YYY"
body: <p>I'm trying to train an XGBoost model in SageMaker. I've manually created a role, named <code>sm_execution_role</code> in the AWS console and given it the trust relationship shown below, where arn:aws:iam::123456789016:user/user1 is the IAM user I want to authorize to perform sagemaker operations. I have run <code>aws configure</code> in the SageMaker terminal and input the access key and secret access key corresponding to user1.  </p>
  
  <pre><code>{
    "Version": "2012-10-17",
    "Statement": [
      {
        "Sid": "",
        "Effect": "Allow",
        "Principal": {
          "Service": "sagemaker.amazonaws.com",
          "AWS": "arn:aws:iam::123456789016:user/user1"
        },
        "Action": "sts:AssumeRole"
      }
    ]
  }
  </code></pre>
  
  <p>In a SageMaker notebook I'm trying to run the following code to generate an XGBoost model, but get the error shown. How can I resolve this? </p>
  
  <pre><code>role = 'sm_execution_role'
  bucket_name = 'my_bucket'
  prefix = 'SageMakerXGB'
  containers = {'us-west-2': '433757028032.dkr.ecr.us-west-2.amazonaws.com/xgboost:latest',
                'us-east-1': '811284229777.dkr.ecr.us-east-1.amazonaws.com/xgboost:latest',
                'us-east-2': '825641698319.dkr.ecr.us-east-2.amazonaws.com/xgboost:latest',
                'eu-west-1': '685385470294.dkr.ecr.eu-west-1.amazonaws.com/xgboost:latest'} 
  my_region = boto3.session.Session().region_name
  s3_input_train = sagemaker.s3_input(s3_data='s3://{}/{}/train'.format(bucket_name, prefix), content_type='csv')
  sess = sagemaker.Session()
  xgb = sagemaker.estimator.Estimator(containers[my_region],role, train_instance_count=1, train_instance_type='ml.m4.xlarge',output_path='s3://{}/{}/output'.format(bucket_name, prefix),sagemaker_session=sess)
  xgb.set_hyperparameters(max_depth=5,eta=0.2,gamma=4,min_child_weight=6,subsample=0.8,num_round=100)
  xgb.fit({'train': s3_input_train})
  ClientError: An error occurred (AccessDenied) when calling the GetRole operation: User: arn:aws:iam::123456789016:user/user1 is not authorized to perform: iam:GetRole on resource: role sm_execution_role
  </code></pre>