By using AWS re:Post, you agree to the AWS re:Post Terms of Use
AWS re:Postre:Post

Cost Intelligence Dashboard (CID) deployment error - access to the AWS-managed s3 bucket that has the required Lambda layer is being denied

0

I've tried deploying the dashboards according to https://catalog.workshops.aws/awscid/en-US/dashboards/foundational/cudos-cid-kpi/deploy but it's getting stuck with the error below. This error comes up when it attempts to deploy the CID cfn template.

Resource handler returned message: "Your access has been denied by S3, please make sure your request credentials have permission to GetObject for aws-managed-cost-intelligence-dashboards-ap-southeast-2/cid-resource-lambda-layer/cid-0.3.0.zip. S3 Error Code: AccessDenied. S3 Error Message: Access Denied (Service: AWSLambdaInternal; Status Code: 403; Error Code: AccessDeniedException

I understand the s3 bucket in question is aws-managed so it should be publicly-accessible but I still granted the relevant IAM role s3 permissions anyway. This didn't make a difference though as the same error is still coming up.

Would appreciate any help. Thank you!

Topics
StorageSecurity, Identity, & ComplianceManagement & GovernanceAnalyticsCloud Financial Management
Tags
Amazon Simple Storage ServiceAWS Identity and Access ManagementAWS CloudFormationAmazon QuickSightCloud Intelligence Dashboards
Language
English
dave_nz
asked 5 months ago557 views
2 Answers
3
Accepted Answer

Please use deployment from our latest released template on s3 bucket https://aws-managed-cost-intelligence-dashboards.s3.amazonaws.com/cfn/cid-cfn.yml

profile pictureAWS
EXPERT
Iakov
answered 5 months ago
profile picture
EXPERT
Oleksii Bebych
reviewed 4 months ago
0

You should have an S3 already where the AWS CUR is delivered in the management account once per day and you need to create a new S3 replication moves this data to the Data Collection Account. In the Management/Payer Account you will need permission to access AWS CloudFormation, AWS Cost & Usage Reports, AWS IAM, AWS Lambda and Amazon S3.

In the Data Collection Account you will need permission to access Amazon Athena, AWS CloudFormation, AWS Directory Service, Amazon EventBridge, AWS Glue, AWS IAM, AWS Lambda, Amazon QuickSight, and Amazon S3 via both the console and the Command Line Tool.

If the issue still persists, please delete the stack and try to redo again from the beginning!

AWS
Anil_AWS
answered 5 months ago

You are not logged in. Log in to post an answer.

A good answer clearly answers the question and provides constructive feedback and encourages professional growth in the question asker.

Guidelines for Answering Questions

Relevant content