Error Code: ScriptExecution.StreamAccess.Authentication

Question

Getting this after submitting a job on AML. Actually I used the same yaml confirations multiple times before and it all worked, but now for some reason I don't know it starts to return this failure.

The role assignment of the storage account also looks right:

Also the compute cluster is assigned to the role.

Job link:https://ml.azure.com/experiments/id/55b92194-c060-4c46-8933-c2231df10005/runs/weihang_denoising-1e9e0266-run_e21-train_rtmix3_mturk_f5_e4_21-a3aa5f75?wsid=/subscriptions/74903b64-1ec7-4e9c-a8a8-7147803bd997/resourceGroups/ic3-media-ai/providers/Microsoft.MachineLearningServices/workspaces/media-ai-algo&tid=72f988bf-86f1-41af-91ab-2d7cd011db47

Answer 1

Hi Weihang Yuan
Hope you are doing well.
I'm glad to hear that your issue has been resolved. And thanks for sharing the information, which might be beneficial to other community members reading this thread as solution. Since the Microsoft Q&A community has a policy that "The question author cannot accept their own answer. They can only accept answers by others ", so I'll convert the previous response to an answer in case you'd like to accept the answer. This will help other users who may have a similar query find the solution more easily. If you have any further questions or concerns, please don't hesitate to ask. We're always here to help.

Issue:
Error Code: ScriptExecution.StreamAccess.Authentication
Answer:
Luckily, I found in the doc of the amulet that I can create a managed (“user-assigned”) identity and assign it to my compute cluster. This worked and the job is successfully running now. Additionally, the managed identity needs Storage Blob Data Contributor role on the storage accounts and AcrPull role for the container registries you intend to use.

If I missed anything please let me know and I'd be happy to add it to my answer, or feel free to comment below with any additional information.

Hope this helps. Do let us know if you have any further queries.

---

If this answers your query, do click Accept Answer and Yes for was this answer helpful.

Answer 2

Hi @Pavankumar Purilla ,

Sorry for the late reply. I'm still working on this error. I've checked that the storage account and compute cluster are in the same region, and didn't find any firewall rules or network security groups that blocking access. For checking authentication token, the syetem log when running the job says it faced status 401: Unauthorized when accessing the stream of the datastore of the blob.
Here's the datastore detail in the AML workspace page:

But the problem is, I'm using amulet to sumbit the job. I have create the probject by:

amlt project create <your-project-name> <storage-account-name>

amlt project checkout <your-project-name> <storage-account-name>

and setup the workspace by:
amlt workspace add <wsname> --resource-group <rg> --subscription <sub-id-or-name>

and add the credential of the storage account by:

amlt cred storage set <storage account> --subscription <sub-id-or-name> --resource-group <rg>

Is there anything missing for amulet to lookp up the authentication key?
Also, I tried to manually update the authentication of the datastore, but facing this:

Here's more details:

Could you please help me with it ?

Answer 3

Thanks @Pavankumar Purilla . It's true that the the managed identity permission is the issue. But I can't change the authentication type of the datastore into managed identity which needs write or admin role of the workspace and I'm not the owner of the workspace.
Luckily, I found in the doc of the amulet that I can create a managed (“user-assigned”) identity and assign it to my compute cluster. This worked and the job is successfully running now. Additionally, the managed identity needs Storage Blob Data Contributor role on the storage accounts and AcrPull role for the container registries you intend to use.

Answer 4

Hi @Pavankumar Purilla ,

We are also getting same error with different error statement.

Please check below error.