System Manager output to s3 bucket

Question

I have a maintenance window setup in System Manager that I'm trying to write output to a S3 bucket in same account. But nothing is showing up. Here's the policy I had in place. I'm assuming its not correct, so what do I need to have instead?

{

"Sid": "AWSSSMWrite",

"Effect": "Allow",

"Principal": {

"AWS": "arn:aws-us-gov:iam:::root"

},

"Action": "s3:PutObject",

"Resource": "arn:aws-us-gov:s3:::prod-ssm/Patching/*",

"Condition": {

"StringEquals": {

"s3:x-amz-acl": "bucket-owner-full-control"

}

Accepted Answer

Bucket policy should like as below:

{
         "Version": "2012-10-17",
         "Statement": [
             {
                 "Sid": "SSMLogging",
                 "Effect": "Allow",
                 "Principal": {
                     "AWS": "arn:aws:iam::SSM_account_id:root"
                 },
                 "Action": [
                     "s3:PutObjectAcl",
                     "s3:PutObject",
                     "s3:GetEncryptionConfiguration"
                 ],
                 "Resource": [
                     "arn:aws:s3:::bucket_name/*",
                     "arn:aws:s3:::bucket_name"
                 ]
             }
         ]
     }

IAM Policy should be as below(for systems manager):

{
        "Version": "2012-10-17",
        "Statement": [
            {
                "Effect": "Allow",
                "Action": [
                    "s3:PutObject",
                    "s3:PutObjectAcl",
                    "s3:GetEncryptionConfiguration"
                ],
                "Resource": [
                    "arn:aws:s3:::bucket-name/*",
                    "arn:aws:s3:::bucket-name"
                ]
            }
        ]
    }

Follow this [re:Post](https://repost.aws/knowledge-center/ssm-output-s3-other-account) step by step.

Answer

Had to also allow permissions due to KMS encryption, but after allowing that; was able to get the data in the bucket.

Answer

Tried it out, but still doesn't seem to be working

Answer

Hi, unfortunately, no it still did not work.

System Manager output to s3 bucket

Relevant content