Amazon Connect S3 Document Upload Fails - ACLs Disabled on amazonconnectuploader Bucket

Question

I'm trying to upload identity documents for an Amazon Connect phone number request using the S3 upload link provided by AWS Support. All uploads fail with "Access denied".

**Environment:**
- Region: eu-west-1 / eu-central-1
- Bucket: amazonconnectuploader-1tc (AWS-owned bucket for Connect document uploads)

**IAM Configuration (verified correct):**
```json
{
  "Effect": "Allow",
  "Action": [
    "kms:Decrypt",
    "kms:GenerateDataKey",
    "s3:ListAllMyBuckets",
    "s3:PutObject",
    "s3:PutObjectAcl",
    "s3:GetBucketOwnershipControls"
  ],
  "Resource": "*"
}
```

**What I've Tested:**
1. Root AWS account user - Access Denied
2. SSO AdministratorAccess role - Access Denied
3. IAM user with above policy - Access Denied
4. AWS Console upload - Access Denied
5. AWS CLI in eu-west-1 - Access Denied (kms:GenerateDataKey)
6. AWS CLI in eu-central-1 - Access Denied (kms:GenerateDataKey)
7. AWS CLI in us-east-1 - Access Denied (kms:GenerateDataKey)
8. SSE-S3 encryption (bypassing KMS) - Still Access Denied

**Error Messages:**
- Console: "You don't have permissions to view the permissions configuration (s3:GetBucketOwnershipControls)"
- CLI: "User is not authorized to perform: kms:GenerateDataKey on this resource because... no resource-based policies allow access"

**Key Finding #1 - KMS Key Policy Issue:**
The KMS encryption key for the bucket doesn't grant cross-account access to customer accounts. For cross-account uploads to KMS-encrypted buckets, both the S3 bucket policy AND the KMS key policy must grant access.

**Key Finding #2 - ACLs Disabled:**
AWS Support instructions reference Steps 5-7: "Expand Permissions, select Specify individual ACL permissions, Add grantee..."

However, this option does not exist in the S3 console. The bucket uses "Bucket owner enforced" Object Ownership, which disables ACLs entirely per AWS documentation:
https://docs.aws.amazon.com/AmazonS3/latest/userguide/about-object-ownership.html

**Related re:Post Discussion:**
Found similar issue: https://repost.aws/questions/QU8Ldh0eawRWO9CLQYsXFf1Q

The solution suggests: "The bucket policy needs to be changed (on the bucket owner's side) to permit s3:GetBucketOwnershipControls. This will allow Account B user to retrieve the bucket's ownership settings and see that ACLs are disabled, and Account B user's console will no longer automatically try to send the upload request with ACL headers."

**Questions:**
1. Should the amazonconnectuploader bucket policy grant s3:GetBucketOwnershipControls to customer accounts when generating upload links?
2. How should the KMS key policy be configured to allow cross-account kms:GenerateDataKey and kms:Decrypt for document uploads?
3. If this is an AWS Connect infrastructure issue, what's the escalation path for Basic Support customers?

The re:Post knowledge article still references the ACL-based workflow:
https://repost.aws/knowledge-center/connect-upload-support-documents

Basic Support has been unable to resolve this and suggested posting here.

Thanks for any guidance.

Everglade2 · Answer

Hi SHAJAM,

Thanks for taking the time to respond.

I gave your suggestion a try. I tested with my SSO AdministratorAccess role which
has full AWS permissions (Resource: "*"), so adding the bucket name specifically
wouldn't grant any additional access. Same result unfortunately.

What's interesting is that the upload actually starts - I can see the file transfer
complete in the CLI output (11.8 KiB transferred) - but then it fails at the KMS
encryption step:

"User is not authorized to perform: kms:GenerateDataKey on this resource because
no resource-based policies allow access"

So the S3 bucket policy seems to be working (PutObject is allowed), but the KMS key
policy doesn't grant my account permission to encrypt. I also tried forcing SSE-S3
(AES256) to bypass KMS entirely, but the bucket policy rejects non-KMS encryption.

The other issue is that AWS's upload instructions reference ACL settings (Steps 5-7:
"Specify individual ACL permissions", add a grantee key, etc.) but those options
don't appear in the console because the bucket has "Bucket owner enforced" which
disables ACLs completely.

So it looks like there's a mismatch between AWS's documented upload process and
the actual bucket configuration. I've raised this with AWS Support but Basic Support
says they can't modify the KMS key policy.

I’m not sure whether I need to purchase premium support to get this resolved, or if I’m missing something obvious.

Thanks again.

Shahed Kazi (@shajam) · Answer

Can you update your IAM configuration and add bucket name in the resource. You don't own this bucket, so, maybe it's not finding it.
Also, since it's an AWS owned bucket, I reckon they have given you the permissions that are needed for the IAM role. From experience, they recommend adding a condition like account id / region in the permission. If they have provided that, please add it to your IAM and retry.

re:Post Agent · Answer

Based on the information provided, you're encountering issues with uploading documents to an AWS-owned S3 bucket (amazonconnectuploader) for Amazon Connect phone number requests. There are several factors contributing to this problem:

1. **ACLs Disabled (Bucket Owner Enforced setting)**: The bucket appears to have the "Bucket owner enforced" Object Ownership setting, which disables ACLs completely. When this setting is applied, requests to set or update ACLs will fail with a 400 error and return the "AccessControlListNotSupported" error code. This explains why you can't follow the AWS Support instructions that reference setting ACL permissions.

2. **KMS Key Policy Restrictions**: The error message about "kms:GenerateDataKey" suggests that the KMS key used for bucket encryption doesn't grant your account the necessary permissions for cross-account access.

3. **Missing Bucket Permissions**: The error about "s3:GetBucketOwnershipControls" indicates your account doesn't have permission to view the bucket's ownership settings.

For this specific AWS-owned bucket scenario:

- The bucket policy would need to be updated by AWS to grant your account permissions for both S3 operations (including s3:GetBucketOwnershipControls) and KMS operations.

- Since ACLs are disabled with the "Bucket owner enforced" setting, the upload process needs to be adjusted to not rely on ACLs. When ACLs are disabled, PUT operations must either specify bucket-owner-full-control ACLs or not specify an ACL at all.

- The KMS key policy would need to allow cross-account access for the kms:GenerateDataKey and kms:Decrypt operations.

Since this involves AWS-owned infrastructure for Amazon Connect, and you have Basic Support, I recommend:

1. Open a support case specifically with the Amazon Connect team (not general AWS support) if possible

2. Clearly explain that the documented process for uploading identity documents references ACL settings that aren't available due to the bucket's Object Ownership configuration

3. Request updated instructions that account for the "Bucket owner enforced" setting

4. Ask if there's an alternative upload method that doesn't require cross-account KMS access

This appears to be a case where the documentation and actual implementation are misaligned, and only AWS can update the bucket policy and KMS key policy for their service-owned resources.  
**Sources**  
[Troubleshooting - Amazon Simple Storage Service](https://docs.aws.amazon.com/AmazonS3/latest/userguide/object-ownership-error-responses.html)  
[Controlling ownership of objects and disabling ACLs for your bucket - Amazon Simple Storage Service](https://docs.aws.amazon.com/AmazonS3/latest/userguide/about-object-ownership.html)

Amazon Connect S3 Document Upload Fails - ACLs Disabled on amazonconnectuploader Bucket

Add your answer

Relevant content