OK, it turned out that we have an SCP policy which enforces us to include the x-amz-server-side-encryption header for each s3:PutObject. Since it is not what AWS Transfer family does, we're getting that access denied error. So the solution is to exclude Transfer Family service from that SCP.
have you checked the server logs ? and if you saw below error then You must specify additional permissions in your policy to grant the required AWS Key Management Service (AWS KMS) permissions. For details, you can check below link
https://docs.aws.amazon.com/transfer/latest/userguide/encryption-at-rest.html
ERROR Message="Access denied" Operation=CLOSE Path=/bucket/user/test.txt BytesIn=13 ERROR Message="Access denied"
Could it be the Key Policy does not allow the role?
Unless the key policy explicitly allows it, you cannot use IAM policies to allow access to a KMS key. Without permission from the key policy, IAM policies that allow permissions have no effect.
Relevant content
- asked 7 months ago
- Accepted Answerasked 2 months ago
AWS OFFICIALUpdated a year ago- AWS OFFICIALUpdated a year ago
- AWS OFFICIALUpdated 2 years ago
- AWS OFFICIALUpdated 2 years ago
Yes, I'm getting the following error in the server logs. ERROR Message="Access denied" Operation=CLOSE Path=/sftp2/abc/test.txt BytesIn=194
However, the bucket key is specified in the policy { "Sid": "EncryptionInAWSTransferFamily", "Action": [ "kms:Decrypt", "kms:Encrypt", "kms:GenerateDataKey" ], "Effect": "Allow", "Resource": "arn:aws:kms:eu-north-1::key/<key-id>" }
Also, the IAM role that is used for the user is allowed in the AWS KMS key policy.