Model Serving Endpoint Creation through API

[pablobd]

Hello,

I am trying to create a model serving endpoint via the API as explained here: https://docs.databricks.com/api/workspace/servingendpoints/create

I created a trusted IAM role with access to DynamoDB for the feature store. I try to use this field,

"instance_profile_arn": "arn:aws:iam:..."

But I get the following error:
b'{"error_code":"BAD_REQUEST","message":"IAM role arn:aws:iam:..." does not have the required trust relationship."}'

Any ideas? What does databricks expect of an IAM role so that it can be used by the model serving cluster?

Thanks

[Debayan]

Hi, Could you please see if this is satisfied, https://docs.databricks.com/en/compute/sql-warehouse/data-access-configuration.html#confirm-or-set-u...

[pablobd · Accepted solution]

Thanks @Debayan - this article helped

[malanevans]

I have a similar issue with a model serving endpoint I created for serving external models (Amazon Bedrock) with Mosaic AI model serving (https://docs.databricks.com/en/generative-ai/external-models/index.html). For this also, I can use an instance profile. I have added trust relationships as suggested to IAM role of the instance profile. Still I get this error.

[denys_t]

Hi, any update on this? I am hosting bedrock in the separate account and configured Databricks to use cross-account setup with all necessary trust configured on both sides. Getting the same error with trust relationship 

[denys_t]

This was a missing piece for me to make the serving endpoint work with the instance profile. The JSON below needs to be added to the IAM role trust which is used for the instance profile:

{
            "Effect": "Allow",
            "Principal": {
                "AWS": [
                    "arn:aws:iam::790110701330:role/serverless-customer-resource-role"
                ]
            },
            "Action": "sts:AssumeRole"
}