Read-S3Object issues Appstream Session

The issue you're experiencing with Read-S3Object not downloading the configuration file from an S3 bucket to C:\Folder during an AppStream 2.0 session start, despite working correctly in the image builder, could be due to several factors:

1. IAM Role Configuration: Ensure that the IAM role attached to your AppStream 2.0 fleet instances has the necessary permissions to access the S3 bucket and perform the GetObject operation. The role should have both ListObject and GetObject permissions for the specific S3 bucket.

2. AppStream Machine Role: When using the IAM role in your AppStream 2.0 fleet instances, you must use the profile name "appstream_machine_role" in your API calls. Make sure your PowerShell script is using this profile name when making the S3 request.

3. Bucket Policy: Verify that the S3 bucket has a bucket policy that explicitly allows the AppStream 2.0 service principal to access and download objects. The policy should grant the "s3:GetObject" permission for the specific objects you're trying to access.

4. VPC Configuration: If you're using a VPC for your AppStream 2.0 fleet, you may need to set up and configure a VPC endpoint for S3. This allows AppStream 2.0 to access your S3 bucket through the private network.

5. Object ACLs: Check the Access Control List (ACL) settings for the specific objects you're trying to download. Even if the bucket permissions are set correctly, individual object ACLs could be restricting access.

6. Encryption: If the objects in your S3 bucket are encrypted, ensure that your IAM role has the necessary permissions to decrypt them.

To troubleshoot this issue, you can try the following:

1. Double-check all permissions and policies mentioned above.

2. Use verbose logging in your PowerShell script to capture more detailed error information.

3. Temporarily enable S3 bucket logging to get more information about access attempts and denials.

4. Test with a simple Read-S3Object command in your session script, such as:

   Read-S3Object -BucketName your-bucket-name -Key your-config-file.txt -File C:\Folder\local-config-file.txt

If the issue persists, you may need to review the AppStream 2.0 session initialization logs or contact AWS support for further assistance.
Sources
Appstream 2.0 Read-S3Object : Access Denied Error | AWS re:Post
S3: Read-S3Object Cmdlet | AWS Tools for PowerShell
Amazon S3 examples using Tools for PowerShell - AWS Tools for PowerShell

Here are a couple things to check:

1. Ensure the IAM Instance Profile you are attaching to your fleet has the correct S3 permissions needed to access the file
2. If you are using the IAM instance Profile you'll need to make sure you are using the appstream_machine_role profile when calling the CLI command. See https://docs.aws.amazon.com/appstream2/latest/developerguide/how-to-use-iam-role-with-streaming-instances.html for more details.