0

I couldn't find this anywhere when I searched but I figured it out and decided to post it here in case anyone else was searching. The permissions needed to the S3 bucket for TimeStream CreateBatchLoadTask API calls are as follows (also includes TimeStream permissions):

{
  "Version": "2012-10-17",
  "Statement": [
      {
          "Sid": "VisualEditor0",
          "Effect": "Allow",
          "Action": [
              "s3:PutObjectAcl",
              "s3:PutObject",
              "s3:GetObject"
          ],
          "Resource": "arn:aws:s3:::*/*"
      },
      {
          "Sid": "VisualEditor1",
          "Effect": "Allow",
          "Action": [
              "s3:ListBucket",
              "s3:GetBucketAcl"
          ],
          "Resource": "arn:aws:s3:::*"
      },
      {
          "Sid": "VisualEditor2",
          "Effect": "Allow",
          "Action": [
              "timestream:WriteRecords",
              "timestream:CreateBatchLoadTask"
          ],
          "Resource": "arn:aws:timestream:*:*:database/*/table/*"
      },
      {
          "Sid": "VisualEditor3",
          "Effect": "Allow",
          "Action": [
              "timestream:DescribeEndpoints"
          ],
          "Resource": "*"
      }
  ]
}

The reason this was difficult is the error message returned by the cli or lambda response doesn't specify the permission needed to perform the action. Just that Access was forbidden to the S3 bucket

No expectation.

Dylan Bartley
  • 1

1 Answers1

0

Just bumped into this one, I was missing s3:GetBucketAcl when creating which caused the error but didn't mention which permission it was missing. The ACL permission solved it for me. Thank you!

Arpit Jain
  • 1,599
  • 9
  • 23
Zarko B
  • 1
  • 2