Unable to create data source from S3 bucket for Knowledge Base using boto3

Question

This is the code

```
response = client.create_data_source(
    dataDeletionPolicy='RETAIN',
    dataSourceConfiguration={![Enter image description here](/media/postImages/original/IMXYKqP4oJQ7GtzeMwNWSVIg)

's3Configuration': {
            'bucketArn': 'arn:aws:s3:::backup-21june',
            'inclusionPrefixes': [
                'string',
            ]
        },
        'type': 'S3',
    },
    description='string',
    knowledgeBaseId='string',
    name='string',
    serverSideEncryptionConfiguration={
        'kmsKeyArn': 'string'
    },
    vectorIngestionConfiguration={
        'chunkingConfiguration': {
            'chunkingStrategy': 'FIXED_SIZE',
        },
    }
)
```

and this is the error : -

`AccessDeniedException: An error occurred (AccessDeniedException) when calling the CreateDataSource operation: User: arn:aws:iam::940037879431:user/grazitti is not authorized to perform: bedrock:CreateDataSource`

This is the policy

![Enter image description here](/media/postImages/original/IMZQ5yBKM2SZG1SSmowiSSvg)

We have the permission here

![Enter image description here](/media/postImages/original/IMWxEEouuGQxCO9zVWutZ8zQ)

The Policy attached to the User

![Enter image description here](/media/postImages/original/IMQPgIwDNbRPysfc5mBxsH4g)

No Permission Boundary Set

![Enter image description here](/media/postImages/original/IMbqAcbChoT6qZPCqNxTM_kw)

JSON Policy

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "VisualEditor0",
            "Effect": "Allow",
            "Action": "bedrock:*",
            "Resource": "*"
        },
        {
            "Effect": "Allow",
            "Action": "sts:AssumeRole",
            "Resource": "arn:aws:iam::940037879431:role/darwin-project-role"
        }
    ]
}

Riku_Kobayashi · Answer

Hello.

Is the IAM policy shown in the image attached to the IAM user mentioned in the error message?  
Also, is there a policy set to deny "bedrock:CreateDataSource" to the IAM user?  
Please also check whether any permission boundaries have been set for the IAM user.  
If a permission boundary is set, please delete the setting.  
https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_boundaries.html

AmarnathAllemgari · Answer

Hello,
Would you be able to share details regarding this role as well: role/darwin-project-role? Does it have a permission boundary set?

Is your AWS account in an organization with SCP? If so you need to ensure that the SCPs allow the necessary actions for creating a data source from an S3 bucket. Even if you have bedrock:fullAccess attached to your user, the SCPs might override this permission if they deny relevant actions.

Evaluate all policies, If there is an explicit deny mentioned anywhere most probably final decision will be deny

Unable to create data source from S3 bucket for Knowledge Base using boto3

Add your answer

Relevant content