medium10 pts · first answer countsiamvpc-networkingtroubleshooting

AccessDenied from a VPC endpoint policy

An instance role allows s3:* and the bucket policy allows the role. The instance reaches S3 through a gateway VPC endpoint. Uploads fail with the error below. What should you change?

An error occurred (AccessDenied) when calling the PutObject operation:
User: arn:aws:sts::111122223333:assumed-role/app-role/i-0abc12 is not authorized
to perform: s3:PutObject on resource: "arn:aws:s3:::app-uploads/a.csv"
because no VPC endpoint policy allows the s3:PutObject action

A.Add s3:PutObject to the role identity policyB.Add the role to the bucket ACL with WRITE permissionC.Rotate the temporary credentials of the roleD.Update the VPC endpoint policy to allow PutObject on that bucket

Discussion 0

Join free to post in the discussion.

AccessDenied from a VPC endpoint policy

Discussion 0

Related questions