Access Denied Exception while accessing Cross Region S3 bucket from EMR.


I am using EMR 6.13.0(EMR on EC2) and it is present in eu-central-1 region. i have my s3 buckets in eu-central-1 and eu-west-1 region, i can be able to access the s3 buckets present in eu-central-1 but not in eu-west-1. I am getting the error as "An error occurred while calling\n: java.nio.file.AccessDeniedException: s3a://mybucket/path/path2: getFileStatus on s3a://mybucket/path/path2: Forbidden (Service: Amazon S3; Status Code: 403; Error Code: 403 Forbidden; " Kindly help me to resolve the issue.

1 Answer


This access denied exception in cross region bucket would be any one or more than one of the following reasons[1],

  • The user's IAM policy doesn't grant access to the bucket.
  • The object is encrypted by AWS Key Management Service (AWS KMS), and the user doesn't have access to the KMS key.
  • A deny statement in the bucket policy or IAM policy is blocking the user's access.
  • The Amazon Virtual Private Cloud (Amazon VPC) endpoint policy is blocking access to the bucket.
  • The AWS Organizations service control policy is blocking access to the bucket.
  • The object doesn't belong to the AWS account that owns the bucket.
  • Requester Pays is enabled on the bucket.

I would like to advice to look into IAM policy for your s3 bucket and check whether you have provided access to the account that you had your EMR cluster created in [2] [3].

  "AuthorizationConfiguration": {
    "EmrFsConfiguration": {
      "RoleMappings": [
          "Role": "arn:aws:iam::DestinationAcctID:role/role_in_destination_account",
          "IdentifierType": "Prefix",
          "Identifiers": [

Note that instead of removing suffix /*, you may add another line as below [4] because it would grant access to your s3 bucket and objects within your s3 bucket:


To check if your account has access to the s3 bucket same region or cross-region, you can simply run $aws s3 ls s3://<bucket>/ on AWS CLI.





answered 6 months ago

You are not logged in. Log in to post an answer.

A good answer clearly answers the question and provides constructive feedback and encourages professional growth in the question asker.

Guidelines for Answering Questions