S3 Access Denied error when running Greengrass V2 device tester (IDT)
While running IDT for my gateway device, I got the following error for StreamManager component:
com.amazonaws.services.s3.model.AmazonS3Exception: Access Denied (Service: Amazon S3; Status Code: 403; Error Code: AccessDenied; Request ID: XXXXXXXXXXXXXXX S3 Extended Request ID: XXXXXXXXXXXXXXX=; Proxy: null). {scriptName=services.aws.greengrass.StreamManager.lifecycle.startup.script, serviceName=aws.greengrass.StreamManager, currentState=RUNNING}
IDT script is creating the roles and s3 buckets on the fly. So its not east to debug via aws console. So I checked cloudtrail. But it seems data events (s3 upload) is not logged in cloudtrail. How can I investigate further ?
Hello,
CloudTrail Event History feature supports only management events. The data events do not show up in Event History and they are sent to the S3 bucket directly that is configured for logging the CloudTrail events. I would suggest you to configure your cloudtrail to enable S3 data logging. You can enable data logging by following the steps given in the documentation[1].
Once the data logging is enabled, you would be able to see the S3 data events being sent in the s3 bucket, that will help to understand which specific S3 API call is getting denied and according to that we can check permission on the role/user calling that API.
In case you require resource specific troubleshooting, feel free to raise a case with AWS support team[2].
Reference [1]https://docs.aws.amazon.com/awscloudtrail/latest/userguide/logging-data-events-with-cloudtrail.html [2]https://us-east-1.console.aws.amazon.com/support/home?region=us-east-1#
Is the proper permissions configured for the role you are using when running IDT?
You can find what permissions your role needs in Step 2: Configure permissions for IDT there is a permission block called s3Resources which lists all the permissions IDT needs.
https://docs.aws.amazon.com/greengrass/v2/developerguide/dev-tst-prereqs.html
Another possible cause is the stream manager might be using the wrong credentials
for more information you can look at Stream manager qualification errors in
https://docs.aws.amazon.com/greengrass/v2/developerguide/idt-troubleshooting.html#stream-manager-qualification-failure
Relevant questions
IDT fails waiting for GG deployment but only for ML tests
Accepted Answerasked 4 months agoS3 Access Denied error when running Greengrass V2 device tester (IDT)
asked a month agoAWS IoT Device Tester for AWS IoT Greengrass V2 Test failed with error: failed to validate lambda publish: timed out
asked 2 months ago[Announcement] AWS IoT Greengrass v2 now supports the use of hardware security modules (HSM)
asked 6 months agoGreengrass V2 positioning for new device
asked 4 months agoIOT Device Tester for IoT Greengrass User Guide: host vs. DUT?
Accepted Answerasked 3 years agoHow to select SKU value while running Greengrass IDT for aws partner device catalog
asked 3 days ago[Greengrass][IDT] test component and MQTT failed with general info
asked 2 months agoGreengrass IDT failing [Error: 126] Failed to find libc on your device
Accepted Answerasked 3 years agoAWS Iot Device Tester SSH Connection failing with EOF
asked 6 months ago