How do I troubleshoot Amazon S3 endpoint connection test failures when using AWS DMS?

Short description

The AWS Identity and Access Management (IAM) role that uses the Amazon S3 endpoint must have the following permissions:

For a source endpoint, you require the S3:GetObject and S3:ListBucket permissions. If versioning is turned on for the S3 bucket, then you also require s3:GetObjectVersion.

For a target endpoint, you require S3:PutObject, S3:DeleteObject, S3PutObjectTagging, and S3ListBucket.

If you don't have the required permissions, then you receive one of the following entries:

• Test Endpoint failed: Application-Status: 1020912, Application-Message: Failed to connect to S3 endpoint. Access denied.
• Test Endpoint failed: Application-Status: 1020912, Application-Message: Failed to list bucket wan-dms Failed to connect to database., Application-Detailed-Message: failed to list bucket wan-dms AWS failed to list bucket List bucket failed with exception 'AccessDenied', message 'Access Denied', error type '15' AWS failed to list bucket Not retriable error: Access Denied
• Test Endpoint failed: Application-Status: 1020912, Application-Message: Failed to connect to database.
• Error Details: [message=putDatabase call failed, errType=ERROR_RESPONSE, status=1020414, errMessage= Failed to connect to database., errDetails=]
• Test Endpoint failed: Application-Status: 1020912, Application-Message: OK

Resolution

Prerequisite: Before you use S3 as a source or target for AWS DMS, review Prerequisites when using Amazon S3 as a source and Prerequisites for using Amazon S3 as a target.

To resolve these errors, grant the minimum IAM permissions to access the S3 endpoint. S3 source and target endpoints have different minimum permissions for AWS DMS.

Note: A successful connection test confirms that the IAM role can access the bucket, but doesn't guarantee that all task modes work. For example, the TRUNCATE_BEFORE_LOAD mode requires s3:DeleteObject to remove existing files before loading. Without this permission, the connection test passes but the task fails.

Example IAM policy for an S3 source endpoint:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "s3:GetObject",
        "s3:ListBucket"
      ],
      "Resource": [
        "arn:aws:s3:::amzn-s3-demo-bucket",
        "arn:aws:s3:::amzn-s3-demo-bucket/*"
      ]
    }
  ]
}

Note: Replace amzn-s3-demo-bucket with your own bucket name.

Example IAM policy for an S3 as target endpoint:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "s3:PutObject",
        "s3:DeleteObject",
        "s3:PutObjectTagging"
      ],
      "Resource": [
        "arn:aws:s3:::amzn-s3-demo-bucket/*"
      ]
    },
    {
      "Effect": "Allow",
      "Action": [
        "s3:ListBucket"
      ],
      "Resource": [
        "arn:aws:s3::: amzn-s3-demo-bucket"
      ]
    }
  ]
}

Note: Replace amzn-s3-demo-bucket with your own bucket name.

Troubleshoot permissions errors

If you still receive connection test failures after you grant the minimum permissions, then take the following actions:

Confirm that the bucket name for the S3 endpoint matches the resource allowed in the IAM role. For example, if the IAM role allows access to only amzn-s3-demo-bucket but you specify amzn-s3-demo-bucket2 in the Bucket name field of the S3 endpoint, then the test connection fails.

Confirm that dms.amazonaws.com is the trusted entity associated with the IAM role.

Example trust policy for AWS DMS:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "",
      "Effect": "Allow",
      "Principal": {
        "Service": "dms.amazonaws.com"
      },
      "Action": "sts:AssumeRole"
    }
  ]
}

If you use AWS Organizations, then confirm that the IAM role is part of an organization that allows access to S3. If your organization doesn't allow access, then AWS DMS can't use that IAM role to connect to the S3 endpoint, even if the role has the required permissions. Contact your account administrator to allow S3 access to your organization.

If your replication instance version is 3.4.7 or higher, then take one of the following actions:

• Make your replication instance subnets publicly routable. Add an internet gateway route to the virtual private cloud (VPC) that your AWS DMS replication instance uses.
• Create VPC endpoints so that your replication instance can access all source and target endpoints that AWS DMS uses.

For more information, see Preparing a migration to AWS DMS versions 3.4.7 and higher.

Related information

How do I troubleshoot AWS DMS endpoint connectivity failures?