- An ECR image containing your inference code (public or private).
- A model artifact archive (for example,
model.tar.gz) uploaded to S3. - A SageMaker execution role with permissions to pull from ECR and read the S3 artifact.
- If the image or S3 bucket is in another AWS account, verify cross-account access and roles.
- Open the Amazon SageMaker console and navigate to Inference → Models.
- Click Create model.
- In the Create model form choose the container input option that lets you “Provide model artifacts and inference image location.” This option points SageMaker to:
- an ECR image for inference, and
- an S3 URI for your model artifacts.
- Fill in the container details:
- Inference image location: the full ECR image URI (for example,
123456789012.dkr.ecr.us-west-2.amazonaws.com/my-inference-image:latest). - Model artifacts: the S3 URI where your model archive is stored (for example,
s3://my-bucket/models/my-model.tar.gz). - (Optional) Environment variables to pass to your container at runtime.
- (Optional) Container entrypoint or command overrides if your image expects them.
- Inference image location: the full ECR image URI (for example,
- (Optional) Configure network isolation and VPC settings:
- If the model needs access to resources inside a VPC, select the VPC and specify subnets and security groups. When you create an endpoint using this model, SageMaker will create ENIs in the selected subnets.
- (Optional) Add tags for cost allocation or organizational metadata.
- Click Create model. The new model will appear in the Models list and can be used to create real-time endpoints or batch transform jobs.
- Inference image location: full ECR URI including account, region, repository, and tag.
- Model artifacts: S3 URI to the
.tar.gzor tarred model directory. - Environment variables: key/value pairs your inference container reads at startup.
- VPC settings: subnets and security groups if your model requires access to VPC resources.
- Tags: optional metadata to help manage and track costs.
Ensure the SageMaker execution role you select has permissions to read the S3 model artifact and to pull the image from ECR. For private ECR repositories, the role typically needs
ecr:GetAuthorizationToken, ecr:BatchGetImage, ecr:GetDownloadUrlForLayer, and commonly ecr:BatchCheckLayerAvailability, plus S3 s3:GetObject for your model artifact. See the IAM documentation for SageMaker for more details.If the image or artifacts are in a different AWS account or behind VPC networking rules, verify cross-account permissions, VPC endpoints, route tables, and security groups. Incorrect permissions or networking will prevent SageMaker from pulling the image or accessing the model artifacts.

- The model will be listed in the SageMaker Models page.
- You can use the model to create a real-time endpoint (for low-latency inference) or a Batch Transform job (for offline inference).
- When you create an endpoint, SageMaker uses the model configuration (including VPC settings) to provision resources and attach ENIs into the selected subnets.
- Create a model using a custom container (SageMaker Developer Guide)
- Amazon ECR: authentication and authorization
- Amazon S3 access control