Appstream 2.0 Read-S3Object : Access Denied Error

Question

Hi,

I am trying to write a powershell session script that locates an s3 bucket and downloads a file to a local directory on my Appstream 2.0 image builder. I have an IAM role attached to the Image Builder that has S3 ListObject and GetObject permission. When I try to run it, I get the following error:

Read-S3Object : Access Denied

In my S3 bucket, I have given ListObject and GetObject permissions as well as have Block Public Access turned off.

I would greatly appreciate any support I can get.

Thanks

Justin_G · Accepted Answer

To use the role you have attached to your AppStream 2.0 fleet instances, you must use the profile name "appstream_machine_role" in your API calls. Are you calling this credential profile with your commands?

See the admin guide for examples: https://docs.aws.amazon.com/appstream2/latest/developerguide/how-to-use-iam-role-with-streaming-instances.html

re:Post Agent · Answer

The "Access Denied" error you're encountering when trying to use Read-S3Object in your AppStream 2.0 image builder could be due to several factors, even though you've taken some important steps. Here are some additional areas to check and potential solutions:

1. Bucket Policy: Ensure that your S3 bucket has a bucket policy that explicitly allows the AppStream 2.0 service principal to access and download objects. The policy should grant the "s3:GetObject" permission for the specific objects you're trying to access.

2. VPC Endpoints: If you're using a VPC for your AppStream 2.0 fleet, you may need to set up and configure a VPC endpoint for S3. This allows AppStream 2.0 to access your S3 bucket through the private network. You'll need to attach a custom policy to your VPC endpoint for Amazon S3 to enable this access.

3. Object ACLs: Check the Access Control List (ACL) settings for the specific objects you're trying to download. Even if the bucket permissions are set correctly, individual object ACLs could be restricting access.

4. Encryption: If the objects in your S3 bucket are encrypted, ensure that your IAM role has the necessary permissions to decrypt them.

5. IAM Role Trust Relationship: Verify that the trust relationship of your IAM role allows the AppStream 2.0 service to assume the role.

6. Cross-Account Access: If the S3 bucket is in a different AWS account than your AppStream 2.0 resources, ensure that you've set up the necessary cross-account permissions.

7. Service Control Policies: If your organization uses AWS Organizations, check for any Service Control Policies (SCPs) that might be restricting S3 access.

If you've confirmed all these settings and are still encountering issues, you may want to temporarily enable S3 bucket logging to get more detailed information about the access attempts and denials. This can help pinpoint the exact cause of the "Access Denied" error.  
**Sources**  
[Amazon S3 Bucket Permissions - Amazon AppStream 2.0](https://docs.aws.amazon.com/appstream2/latest/developerguide/s3-permissions.html)  
[Error opening image in s3 bucket | AWS re:Post](https://repost.aws/questions/QUUNrMhg87TealaO_r4DW3Gw/error-opening-image-in-s3-bucket)  
[Using Amazon S3 VPC Endpoints for AppStream 2.0 Features - Amazon AppStream 2.0](https://docs.aws.amazon.com/appstream2/latest/developerguide/managing-network-vpce-iam-policy.html)  
[Troubleshoot 403 Access Denied error in Amazon S3 | AWS re:Post](https://repost.aws/articles/ARiuGcDHgxR2ShA6jBJEB7pw/troubleshoot-403-access-denied-error-in-amazon-s3)

Appstream 2.0 Read-S3Object : Access Denied Error

Relevant content