✎ [V7] ISSUE: AhsayCBS "Failed to access destination AmazonS3-1. Reason=Access Denied" error returned when creating predefined destination for AmazonS3 [Ahsay Wiki]

This page is read only. You can view the source, but not change it. Ask your administrator if you think this is wrong.
===== [V7]  ISSUE: AhsayCBS "Failed to access destination AmazonS3-1. Reason=Access Denied" error returned when creating predefined destination for AmazonS3   =====

<html><div class="content">
 <b>
  Article ID:
 </b>
 5228
 <br/>
 <b>
  Reviewed:
 </b>
 2017-01-13
 <br/>
 <br/>
 <b>
  Product Version:
 </b>
 <br/>
 AhsayOBM: 7.5.0.0  to 7.x
 <br/>
 OS: ALL
 <br/>
 <br/>
</html>

<html>
<FONT COLOR=red SIZE=+1>
<B>ATTENTION</B>
1st January, 2022: v7 officially End-of-Life [<A HREF=https://wiki.ahsay.com/doku.php?id=public:announcement:ahsay_v7_eol>details</A>]
</FONT>
</html>


===== Problem Description =====
<html>
 When performing creating a new predefined destination for AmazonS3 on AhsayCBS, the following error is shown in the AhsayCBS web admin console
 <b>
  “Failed to access destination AmazonS3-1. Reason=Access Denied”
 </b>
 <br/>
    <img style="width:75%; border:thin solid black" src="http://wiki.ahsay.com/lib/exe/fetch.php?media=public:5228_0.png"/>
 <br/>
 <br/>
 <b>
  Cause:
 </b>
 <br/>
 This issue is a result of insufficient permission assignments in the Amazon Policy group which grants permissions to the affected bucket.
 <br/>
 <br/>
 When granting access permissions to a bucket via policy control correct access permission for both the files/folders within the bucket, as well as the bucket itself must be granted, for example the bucket
 <b>
  “ahsay-1b73760024477”
 </b>
 and files/folders within the
 <b>
  “ahsay-1b73760024477/*”
 </b>
 .
 <br/>
 <br/>
</html>
===== Resolution =====
<html>
 To resolve the issue, please assign the following permissions to the policy “Get”, “List”,”Delete”, and “Put”
 <br/>
 <ol style="list-style-type: decimal">
  <li><font color=black>
   Login to Amazon S3 web service console.
   <br/>
      <img style="width:75%; border:thin solid black" src="http://wiki.ahsay.com/lib/exe/fetch.php?media=public:5228_1.png"/>
   <br/>
  </font></li>
  <li><font color=black>
   Enter “IAM” for the Identity and Access Management page in the search box.
   <br/>
      <img style="width:75%; border:thin solid black" src="http://wiki.ahsay.com/lib/exe/fetch.php?media=public:5228_2.png"/>
   <br/>
  </font></li>
  <li><font color=black>
   Select “Policies” and enter policy name to search for the policy, for example “cbs”
   <br/>
      <img style="width:75%; border:thin solid black" src="http://wiki.ahsay.com/lib/exe/fetch.php?media=public:5228_3.png"/>
   <br/>
  </font></li>
  <li><font color=black>
   Click on the policy name, for example
   <b>
    “CBS-Server-Access-Policy”
   </b>
   is used to assign permission to the bucket “ahsay-1b73760024477”
   <br/>
   <br/>
   In the “Policy Document” Tab enter the following JSON policy script to assign the correct permissions to the bucket.
   <br/>
   <br/>
   For example, assign
   <b>
    “Get”, “List”,”Delete”, and “Put”
   </b>
   permissions to the following bucket
   <b>
    "ahsay-1b73760024477"
   </b>
   and all files/folders within the bucket
   <b>
    "ahsay-1b73760024477/*"
   </b>
   <br/>
   <i>
    {
    <br/>
    "Version": "2012-10-17",
    <br/>
    "Statement": [
    <br/>
    {
    <br/>
    "Sid": "Stmt1481791539000",
    <br/>
    "Effect": "Allow",
    <br/>
    "Action": [
    <br/>
    "s3:Get*",
    <br/>
    "s3:List*",
    <br/>
    "s3:Delete*",
    <br/>
    "s3:Put*"
    <br/>
    ],
    <br/>
    "Resource": [
    <br/>
    "arn:aws:s3:::ahsay-1b73760024477",
    <br/>
    "arn:aws:s3:::ahsay-1b73760024477/*"
    <br/>
    ]
    <br/>
    }
    <br/>
    ]
    <br/>
    }
   </i>
   <br/>
   <div class="inline-attachment">
    <dl>
     <dt class="attach-image">
      <img style="width:75%; border:thin solid black" src="http://wiki.ahsay.com/lib/exe/fetch.php?media=public:5228_4.png"/>
   <br/>
  </font></li>
  <li><font color=black>
   Click on [Validate Policy] button, once the policy has been validated. Click on [Save] Button.
  </font></li>
  <li><font color=black>
   Login to AhsayCBS web admin and retry adding the predefinee destination
  </font></li>
 </ol>
 <br/>
 <b>
  References:
 </b>
 <br/>
 <!-- m -->
 <a class="postlink" href="https://docs.aws.amazon.com/AmazonS3/latest/dev/access-policy-language-overview.html">
  https://docs.aws.amazon.com/AmazonS3/la ... rview.html
 </a>
 <!-- m -->
 <br/>
 <!-- m -->
 <a class="postlink" href="https://docs.aws.amazon.com/AmazonS3/latest/dev/example-bucket-policies-vpc-endpoint.html">
  https://docs.aws.amazon.com/AmazonS3/la ... point.html
 </a>
 <!-- m -->
 <br/>
 <!-- m -->
 <a class="postlink" href="https://docs.aws.amazon.com/AmazonS3/latest/dev/walkthrough1.html#walkthrough-grant-user1-permissions">
  https://docs.aws.amazon.com/AmazonS3/la ... ermissions
 </a>
 <!-- m -->
 <br/>
 <br/>
</html>
===== Keywords =====
 Amazon S3, predefined destination, IAM, permissions, bucket, access denied, Failed to access destination, policy control, validate policy, policies
User Tools

Site Tools

Page Tools
