Custom docker image for inference - amazon-sagemaker

Question

I've created a docker image web service I'm trying to get to run on SageMaker as an inference service.
I've created an execution role with the following permissions:
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": [
"s3:ListBucket"
],
"Resource": [
"arn:aws:s3:::arn:aws:s3:::XXXXX-ai-sagemaker"
]
},
{
"Effect": "Allow",
"Action": [
"s3:GetObject",
"s3:PutObject"
],
"Resource": [
"arn:aws:s3:::arn:aws:s3:::XXXXX-ai-sagemaker/*"
]
},
{
"Effect": "Allow",
"Action": [
"sagemaker:BatchPutMetrics",
"ecr:GetAuthorizationToken",
"ecr:ListImages"
],
"Resource": "*"
},
{
"Effect": "Allow",
"Action": [
"ecr:BatchCheckLayerAvailability",
"ecr:GetDownloadUrlForLayer",
"ecr:BatchGetImage"
],
"Resource": [
"arn:aws:ecr:eu-central-1:553XXXXXXXX:repository/similarity"
]
},
{
"Effect": "Allow",
"Action": "cloudwatch:PutMetricData",
"Resource": "*",
"Condition": {
"StringLike": {
"cloudwatch:namespace": [
"*SageMaker*",
"*Sagemaker*",
"*sagemaker*"
]
}
}
},
{
"Effect": "Allow",
"Action": [
"logs:CreateLogStream",
"logs:PutLogEvents",
"logs:CreateLogGroup",
"logs:DescribeLogStreams"
],
"Resource": "arn:aws:logs:*:*:log-group:/aws/sagemaker/*"
}
]
}
I have the docker image hosted on a private repository in ECR - The role has permission to pull images from the repository.
When running the following python code:
import boto3
from time import gmtime, strftime
model_name = 'similarity-model' + strftime("%Y-%m-%d-%H-%M-%S", gmtime())
image_config = {
'RepositoryAccessMode': 'Vpc'
}
vpc_config = {
'SecurityGroupIds': ['sg-1ebfXXXX'],
'Subnets': ['subnet-8a47XXXX', 'subnet-b707XXX']
}
primary_container = {
'ContainerHostname': 'ModelContainer',
'Image': '553XXXXXX.dkr.ecr.eu-central-1.amazonaws.com/similarity:latest',
'ImageConfig': image_config
}
sm = boto3.client('sagemaker')
execution_role_arn = 'arn:aws:iam::553XXXXXX:role/service-role/SageMaker-sagemaker'
try:
resp = sm.create_model(
ModelName=model_name,
PrimaryContainer=primary_container,
ExecutionRoleArn=execution_role_arn,
VpcConfig=vpc_config,
)
except Exception as e:
print(f'error calling CreateModel operation: {e}')
else:
print(resp)
I recieve the following error from create_model():
An error occurred (ValidationException) when calling the CreateModel operation: Using ECR image "553XXXXXXX.dkr.ecr.eu-central-1.amazonaws.com/similarity:latest" with Vpc repository access mode is not supported.
Any suggestions would be good at this point :)