Cost Intelligence Dashboard (CID) deployment error - access to the AWS-managed s3 bucket that has the required Lambda layer is being denied

Question

I've tried deploying the dashboards according to https://catalog.workshops.aws/awscid/en-US/dashboards/foundational/cudos-cid-kpi/deploy but it's getting stuck with the error below. This error comes up when it attempts to deploy the CID cfn template.

Resource handler returned message: "Your access has been denied by S3, please make sure your request credentials have permission to GetObject for aws-managed-cost-intelligence-dashboards-ap-southeast-2/cid-resource-lambda-layer/cid-0.3.0.zip. S3 Error Code: AccessDenied. S3 Error Message: Access Denied (Service: AWSLambdaInternal; Status Code: 403; Error Code: AccessDeniedException

I understand the s3 bucket in question is aws-managed so it should be publicly-accessible but I still granted the relevant IAM role s3 permissions anyway. This didn't make a difference though as the same error is still coming up.

Would appreciate any help. Thank you!

Accepted Answer

Please use deployment from our latest released template on s3 bucket https://aws-managed-cost-intelligence-dashboards.s3.amazonaws.com/cfn/cid-cfn.yml

Answer

You should have an S3 already where the AWS CUR is delivered in the management account once per day and you need to create a new S3 replication moves this data to the Data Collection Account.
In the Management/Payer Account you will need permission to access AWS CloudFormation, AWS Cost & Usage Reports, AWS IAM, AWS Lambda and Amazon S3.

In the Data Collection Account you will need permission to access Amazon Athena, AWS CloudFormation, AWS Directory Service, Amazon EventBridge, AWS Glue, AWS IAM, AWS Lambda, Amazon QuickSight, and Amazon S3 via both the console and the Command Line Tool.

If the issue still persists, please delete the stack and try to redo again from the beginning!

Cost Intelligence Dashboard (CID) deployment error - access to the AWS-managed s3 bucket that has the required Lambda layer is being denied

Conteúdo relevante