title: AWS SageMaker: PermissionError: Access Denied - Reading data from S3 bucket
body: <p>I am using AWS SageMaker. I already used it before and I had no problems reading data from an S3 bucket.
  So, I set up a new notebook instance and id this:</p>
  <pre><code>from sagemaker import get_execution_role
  role = get_execution_role()
  
  bucket='my-bucket'
  
  data_key = 'myfile.csv'
  data_location = 's3://{}/{}'.format(bucket, data_key)
  
  df = pd.read_csv(data_location)
  </code></pre>
  <p>What I got is this:</p>
  <pre><code>PermissionError: Access Denied
  </code></pre>
  <p>Note: I checked the IAM Roles and also the policies and it seems to me that I have all the necessary rights to access the S3 bucket (AmazonS3FullAccess etc. are granted). What is different from the situation before is that my data is encrypted. Is there something I have to set up besides the roles?</p>
  <p>Edit:</p>
  <p>The role I use consist of three policies. These are</p>
  <ul>
  <li>AmazonS3FullAccess</li>
  <li>AmazonSageMakerFullAccess</li>
  </ul>
  <p>and an Execution Role where I added kms:encrypt and kms:decrypt. It looks like this one:</p>
  <pre><code>{
      &quot;Version&quot;: &quot;2012-10-17&quot;,
      &quot;Statement&quot;: [
          {
              &quot;Sid&quot;: &quot;xyz&quot;,
              &quot;Effect&quot;: &quot;Allow&quot;,
              &quot;Action&quot;: [
                  &quot;s3:PutObject&quot;,
                  &quot;s3:GetObject&quot;,
                  &quot;s3:ListBucket&quot;,
                  &quot;s3:DeleteObject&quot;,
                  &quot;kms:Encrypt&quot;,
                  &quot;kms:Decrypt&quot;
              ],
              &quot;Resource&quot;: &quot;arn:aws:s3:::*&quot;
          }
      ]
  }
  </code></pre>
  <p>Is there something missing?</p>