Hello everyone, I’m experiencing an issue with my AWS-hosted LakeFS. I successfully imported an S3 bucket into LakeFS, but whenever I try to view the file overview, download a file, or generate a presigned URL, I get the following error:

AccessDenied arn:aws:sts::XXXX:assumed-role/YYYY/i-AAAA is not authorized to perform: s3:GetObject on resource: ...

My bucket policy includes:

{

"Sid": "lakeFSObjects",

"Effect": "Allow",

"Principal": {

"AWS": "arn:aws:iam::XXX:role/[ROLE_NAME]"

},

"Action": [

"s3:GetObject",

"s3:PutObject",

"s3:AbortMultipartUpload",

"s3:ListMultipartUploadParts"

],

"Resource": "arn:aws:s3:::[BUCKET NAME]/*"

},

I’m not sure if it’s related, but I also cannot download the file using the LakeFS Python library. For reference, my bucket is located in eu-central-1. Does anyone have suggestions on how to resolve this issue? Thank you in advance!

Did you import from the same bucket where your repository's storage namespace is? If not, you need to add permissions to that bucket as well

Yes I am using the same bucket, with different "folder" of course

Regardless of lakeFS, it seems like your role is not allowed to read objects from the imported path. I would start by trying to make that work locally, then attaching that role to lakeFS with the right permissions.

Yes you are right, from the EC2 in SSH I can do the command

aws s3 ls

but I can't

aws s3 cp

, I get an AccessDenied error