Configure DMS S3 Target Endpoint for Requester Pays Bucket

Question

I'm trying to configure an S3 Target Endpoint in DMS to insert load result files into a bucket with Requester Pays enabled in another AWS account. 
The IAM Role / Instance Profile has all the necessary S3 permissions (s3:*) granted to all resources, and when I disable the Requester Pays option on the bucket it works fine with the same Role, DMS Rules and exactly other settings. However, when I re-enable Requester Pays, it stops working and receive a 403 Access Denied error from S3. 
What parameter should I add on S3 Target Endpoint to make it work with a bucket with Requester Pays enabled? I couldn't find a solution in the AWS docs. Thanks.

Kidd Ip · Answer

Please verify x-amz-request-payer header is included in the S3 Target Endpoint settings:

JSON

{
  "requesterPaysEnabled": true
}

Didier Durand · Answer

Hi,

The issue and its solution is fully detailled in https://repost.aws/knowledge-center/s3-cross-account-access-denied

```
You turned on Requester Pays for the bucket

If you turned on Requester Pays for your bucket, then users from other accounts must 
specify the request-payer parameter when sending requests to your bucket. Otherwise, 
those users get an Access Denied error.

To resolve this error, take the following actions:

For DELETE, GET, HEAD, POST, and PUT requests, include x-amz-request-payer : requester in the header.
For signed URLs, include x-amz-request-payer=requester in the request.
For AWS CLI commands, include the --request-payer parameter. Example:
$ aws s3 cp exampleobject.jpg s3://DOC-EXAMPLE-BUCKET/exampleobject.jpg --request-payer requester
```

I understand that DMS makes the access request on your behalf and that you may not be able to change. But, at least, you can verify that it is the  root cause of your trouble and open a Support case in your account if DMS doesn't set this header.

Best,

Didier

Configure DMS S3 Target Endpoint for Requester Pays Bucket

Add your answer

Relevant content