Terraform创建SageMaker模型报错：非ECR镜像需VPC仓库访问模式

错误根源 #

报错的核心原因是：你传入的镜像名称不是完整的ECR镜像URI，SageMaker将其识别为非ECR镜像，而你未配置VPC仓库访问模式，导致验证失败。

问题出在Terraform代码的属性使用错误：你调用aws_sagemaker_prebuilt_ecr_image数据源时，用了repository_name属性，但该属性仅返回镜像仓库的名称（比如sagemaker-scikit-learn），而非SageMaker所需的完整ECR镜像URI（格式类似123456789012.dkr.ecr.us-east-1.amazonaws.com/sagemaker-scikit-learn:0.23-1-cpu-py3）。

解决方案 #

将两个aws_sagemaker_model资源中primary_container的image字段值，从repository_name替换为image_uri属性即可。

修改后的完整代码片段 #

SageMaker Model资源部分

resource "aws_sagemaker_model" "sagemaker_prediction" {
  count               = var.enable_departments_endpoint == true ? 1 : 0
  name               = "${var.environment}-departments-v2"
  execution_role_arn = aws_iam_role.sagemaker_prediction.arn

  primary_container {
    image          = data.aws_sagemaker_prebuilt_ecr_image.prediction.image_uri
    model_data_url = var.departments_model_s3_artefact
    environment    = var.sagemaker_vars
  }

  tags = local.common_tags
}

resource "aws_sagemaker_model" "sagemaker_prediction_electronics"{
  count              = var.enable_electronics_endpoint == true ? 1 : 0
  name               = "${var.environment}-electronics-v2-serverless"
  execution_role_arn = aws_iam_role.sagemaker_prediction.arn

  primary_container {
    image          = data.aws_sagemaker_prebuilt_ecr_image.cat_prediction.image_uri
    model_data_url = var.electronics_model_s3_artefact
  }
  tags = local.common_tags
}

镜像数据源部分（无需修改）

data "aws_sagemaker_prebuilt_ecr_image" "prediction" {
  repository_name = "sagemaker-scikit-learn"
  image_tag       = "0.23-1-cpu-py3"
}

data "aws_sagemaker_prebuilt_ecr_image" "cat_prediction" {
   repository_name = "tensorflow-inference"
   image_tag = "1"
}

原理说明 #

aws_sagemaker_prebuilt_ecr_image数据源的image_uri属性会自动生成包含AWS账号ID、区域信息的完整ECR镜像地址，SageMaker能直接识别这是合法的ECR镜像资源，无需额外配置VPC仓库访问模式，即可正常创建模型。

内容的提问来源于stack exchange，提问作者Abhay Kumar