wget failing in SMStudio with 'Unable to locally verify the issuer's authority'

[athewsey]

Category

Compatibility Issue

🐛 Describe the bug

In the last couple of days I've noticed (in us-east-1, on two separate AWS accounts) that any time I run a wget to a HTTPS URL in SageMaker Studio (Distribution v1.8), it fails with an error like:

--2024-06-11 08:16:07--  https://aws-blogs-artifacts-public.s3.amazonaws.com/artifacts/ML-FMBT/manifest.txt
Resolving aws-blogs-artifacts-public.s3.amazonaws.com (aws-blogs-artifacts-public.s3.amazonaws.com)... 52.216.54.89, 3.5.28.235, 3.5.11.187, ...
Connecting to aws-blogs-artifacts-public.s3.amazonaws.com (aws-blogs-artifacts-public.s3.amazonaws.com)|52.216.54.89|:443... connected.
ERROR: cannot verify aws-blogs-artifacts-public.s3.amazonaws.com's certificate, issued by ‘CN=Amazon RSA 2048 M01,O=Amazon,C=US’:
  Unable to locally verify the issuer's authority.
To connect to aws-blogs-artifacts-public.s3.amazonaws.com insecurely, use `--no-check-certificate'.

An example command that shows the issue:

!mkdir -p data
!wget -O data/CC_Agreements.zip https://files.consumerfinance.gov/a/assets/Credit_Card_Agreements_2020_Q4.zip

🐛 Describe the expected behavior

These fetches used to work just fine, and it's not just S3 that's affected (I had one against https://files.consumerfinance.gov/ as well). Perhaps there's some kind of certificate configuration issue? My relevant SageMaker Domains are configured for direct internet access, so it shouldn't be a VPC problem.

Currently I'm working around this by switching to curl where possible, but that's not straightforward for scripts we're consuming that use wget internally.

Image Tags

SM Studio Distribution v1.8 (CPU), 2024-06-11

[aws-tianquaw]

Hi @athewsey, It seems like some permission/certificate setup issue instead of the issue with SMD images. Did you encounter any issue with the image itself?

For your use case, the fastest and easiest way to copy files from S3 is to use AWS CLI tool. For example, use aws s3 cp <s3_uri> <local_path> to download from S3 to your local file system. SMD image already have AWS CLI installed, so you should be able to use it directly. See documentation: https://docs.aws.amazon.com/cli/latest/reference/s3/cp.html