S3 Access Denied error when running Greengrass V2 device tester (IDT)

Question

While running IDT for my gateway device, I got the following error for StreamManager component:

```
com.amazonaws.services.s3.model.AmazonS3Exception: Access Denied (Service: Amazon S3; Status Code: 403; Error Code: AccessDenied; Request ID: XXXXXXXXXXXXXXX S3 Extended Request ID: XXXXXXXXXXXXXXX=; Proxy: null). {scriptName=services.aws.greengrass.StreamManager.lifecycle.startup.script, serviceName=aws.greengrass.StreamManager, currentState=RUNNING} 
```

IDT script is creating the roles and s3 buckets on the fly. So its not east to debug via aws console. So I checked cloudtrail. But it seems data events (s3 upload) is not logged in cloudtrail. How can I investigate further ?

Answer

Hello,

CloudTrail Event History feature supports only management events. The data events do not show up in Event History and they are sent to the S3 bucket directly that is configured for logging the CloudTrail events. I would suggest you to configure your cloudtrail to enable S3 data logging. You can enable data logging by following the steps given in the documentation[1].

Once the data logging is enabled, you would be able to see the S3 data events being sent in the s3 bucket, that will help to understand which specific S3 API call is getting denied and according to that we can check permission on the role/user calling that API.

In case you require resource specific troubleshooting, feel free to raise a case with AWS support team[2].

Reference
[1]https://docs.aws.amazon.com/awscloudtrail/latest/userguide/logging-data-events-with-cloudtrail.html
[2]https://us-east-1.console.aws.amazon.com/support/home?region=us-east-1#

Answer

Is the proper permissions configured for the role you are using when running IDT?  
You can find what permissions your role needs in ``Step 2: Configure permissions for IDT`` there is a permission block called `s3Resources` which lists all the permissions IDT needs.
https://docs.aws.amazon.com/greengrass/v2/developerguide/dev-tst-prereqs.html

Another possible cause is the stream manager might be using the wrong credentials
for more information you can look at `Stream manager qualification errors` in
https://docs.aws.amazon.com/greengrass/v2/developerguide/idt-troubleshooting.html#stream-manager-qualification-failure

S3 Access Denied error when running Greengrass V2 device tester (IDT)

Relevant content