S3 to GCS - Lambda Access Denied Error

Question

Hi,

We're trying to achieve a use case wherein a file uploaded in s3 should be transferred to gcs. We've prepared the code in node.js and everything is all set but while testing, we're receiving below error.

2024-04-22T03:18:16.399Z	b1d1e726-efba-4b59-9fba-97e5c8a0bf34	ERROR	Error transferring file from S3 to GCS: AccessDenied: Access Denied
    at Request.extractError (/var/task/node_modules/aws-sdk/lib/services/s3.js:712:35)
    at Request.callListeners (/var/task/node_modules/aws-sdk/lib/sequential_executor.js:106:20)
    at Request.emit (/var/task/node_modules/aws-sdk/lib/sequential_executor.js:78:10)
    at Request.emit (/var/task/node_modules/aws-sdk/lib/request.js:686:14)
    at Request.transition (/var/task/node_modules/aws-sdk/lib/request.js:22:10)
    at AcceptorStateMachine.runTo (/var/task/node_modules/aws-sdk/lib/state_machine.js:14:12)
    at /var/task/node_modules/aws-sdk/lib/state_machine.js:26:10
    at Request. (/var/task/node_modules/aws-sdk/lib/request.js:38:9)
    at Request. (/var/task/node_modules/aws-sdk/lib/request.js:688:12)
    at Request.callListeners (/var/task/node_modules/aws-sdk/lib/sequential_executor.js:116:18) {
  code: 'AccessDenied',
  region: null,
  time: 2024-04-22T03:18:16.398Z,
  requestId: '6D7DHEZQ1AVQE755',
  extendedRequestId: 'W1uwlc0XECIOIRj0dC2Uia5EIa+RDWVDC4L1keYHFrHLPkZPZ2yjL5uaBkwuHiu4i2UfluIKTDE=',
  cfId: undefined,
  statusCode: 403,
  retryable: false,
  retryDelay: 94.69915366425978
}

We've checked everything wrt to permissions on both s3 and gcp but not able to figure the root cause. Can anyone please help on the error above?

Answer

Hello.

What code are you using?  
Although it is not a javascript sample, I think that the code and migration method itself described in the following document will be helpful.  
https://cloud.google.com/storage/docs/aws-simple-migration#storage-list-buckets-s3-python

Answer

Hello, based on the error message, this looks S3 access denied error.

You may run this Systems Manager runbook to troubleshoot yourself to identify the reason for 403.

https://repost.aws/knowledge-center/s3-troubleshoot-403-resource-same-account

If you have AWS support, you can create a case and provide the above error message with the request IDs.

S3 to GCS - Lambda Access Denied Error

Relevant content