> ## Documentation Index
> Fetch the complete documentation index at: https://docs.maia.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Not authorized to perform an action on an AWS resource

> Resolve the AWS error returned when your Maia runner's identity lacks permission to perform an action on a resource.

## Error message

```text wrap theme={null}
User: arn:aws:sts::<account>:assumed-role/<role>/<session> is not authorized to perform: s3:PutObject on resource: arn:aws:s3:::<bucket>/<path>
```

This error can appear when using the following components: [Data Transfer](https://docs.maia.ai/docs/components/data-transfer.md), [Run Orchestration](https://docs.maia.ai/docs/components/run-orchestration.md), [S3 Load](https://docs.maia.ai/docs/components/s3-load.md), and [S3 Unload](https://docs.maia.ai/docs/components/s3-unload.md).

### Explanation

AWS refused a request from the identity your Maia runner uses. Your pipeline logic is fine. The identity doesn't have the permission named in the message.

### Potential causes

* The AWS Identity and Access Management (IAM) policy attached to the Maia runner's role or user doesn't allow the action (for example `s3:PutObject`) on that bucket or path.
* A bucket policy, service control policy, or permissions boundary blocks the action, even if the IAM policy allows it.
* The data is encrypted with an AWS Key Management Service (KMS) key and the role isn't allowed to use the key (`kms:Decrypt` to read, `kms:GenerateDataKey` to write).
* The Maia runner is running under a different role than you expected.

***

## Resolve the error

1. Read the message and note three things: the identity, which is the Amazon Resource Name (ARN) after `User:`, the action after `perform:`, and the resource after `on resource:`.

2. In AWS IAM, open that role or user and confirm a policy allows the action on the full resource ARN, including the folder prefix and `/*`.

   Here is an example policy statement. Replace the placeholders with your own values:

   ```json theme={null}
   {
     "Effect": "Allow",
     "Action": ["s3:PutObject", "s3:GetObject", "s3:ListBucket"],
     "Resource": [
       "arn:aws:s3:::<bucket>",
       "arn:aws:s3:::<bucket>/<path>/*"
     ]
   }
   ```

3. Check the bucket policy and any organization-level policies for an explicit `Deny` that matches the identity or path.

4. If the message names `kms:` actions, add them to the role's policy and to the key policy of the KMS key that encrypts the bucket.

5. Wait a few minutes for IAM changes to propagate, then re-run the pipeline.

6. If you still need help, [contact Maia Support](https://support.matillion.com/s/) and include the items listed below.

   * The full error text, including the role ARN.
   * The bucket, path, and KMS key involved (if any).

> [!NOTE]
>
> If a component transfers many files in a loop, every file fails with its own copy of this error. They all share one cause, so you only need to fix the permission once.

### Prevent future errors

To prevent this error occurring again:

* Scope permissions to the exact bucket and prefix the pipeline uses, and keep the policy in version control. For more information, read [Cloud provider credentials](https://docs.maia.ai/docs/guides/cloud-credentials.md#roles-and-permissions-for-cloud-storage).
* Test a new role with a pipeline that moves a single file before running the full load.


## Related topics

- [Azure Storage authorization permission mismatch](https://docs.maia.ai/docs/errors/azure-storage-authorization-permission-mismatch.md)
- [Agent internal error](https://docs.maia.ai/docs/errors/agent-internal-error.md)


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.