Skip to content

Missing AWS managed S3GrantAccess application in user Access Portal

0

As a developer, I've been experimenting with IAM Identity Center and S3. The Identity Center is not for Organizations, but for test and development (limited to one account).

In S3, I have created an S3AccessGrants AWS managed application. I can see the application in the Identity Center. The "User and group assignments" option in the application config is set to "Do not require assignments". I also created users and groups in the Identity Center. I successfully log into Access Portal as one of the test users.

So, I would expect the user to be able to see the application on their Access Portal page to be able to generate a temporary access token, but the application is not listed for the user. It is not listed in the user page either. On the tab "Applications" on the user page, there is a notice "No assigned applications".

Could you please guide me to how I could possibly get it working?

A similar question has been asked before, but I have managed to advance further than the author of the question, as I already created the S3GrantAccess application from inside the S3 service.

1 Answer
2

Based on the information provided, it seems that you've taken the correct steps to set up the S3AccessGrants AWS managed application in IAM Identity Center. However, there are a few points to consider that might help resolve the issue of the application not appearing in the user's Access Portal:

  1. Application Visibility: Even though you've set the "User and group assignments" option to "Do not require assignments," this doesn't automatically make the application visible to all users. It only means that users don't need to be explicitly assigned to use the application if they can see it.

  2. Application Configuration: Ensure that you've completed all the necessary configuration steps for the S3AccessGrants application. This includes associating the application with the appropriate S3 Access Grants instance and configuring any required settings within the S3 service.

  3. IAM Identity Center Instance Association: Make sure that you've associated your S3 Access Grants instance with your IAM Identity Center instance. This association is crucial for the application to function correctly and be visible to users.

  4. Permissions and Policies: Check if there are any service control policies (SCPs) or IAM policies that might be restricting access to the application or its visibility.

  5. Application Assignment: Although you've set it to not require assignments, you might want to try explicitly assigning the application to a test user or group to see if that makes it visible.

  6. Access Portal Configuration: Verify that the Access Portal itself is correctly configured to display AWS managed applications.

  7. Browser Cache and Cookies: As a troubleshooting step, try clearing the browser cache and cookies, or use a different browser to log into the Access Portal.

  8. Wait Time: Sometimes, changes in IAM Identity Center can take a short while to propagate. Try waiting for a few minutes and then refreshing the Access Portal.

If after checking these points the application still doesn't appear, you may need to review the S3 Access Grants instance configuration and ensure all steps for setting up the AWS managed application have been completed correctly. If the issue persists, it would be advisable to contact AWS support for further assistance, as there might be a specific configuration detail or a potential bug that needs to be addressed.
Sources
AWS managed applications - AWS IAM Identity Center
Working with S3 Access Grants instances - Amazon Simple Storage Service
How to develop a user-facing data application with IAM Identity Center and S3 Access Grants (Part 1) | AWS Storage Blog

answered 2 years ago

EXPERT

reviewed 2 years ago

You are not logged in. Log in to post an answer.

A good answer clearly answers the question and provides constructive feedback and encourages professional growth in the question asker.