I'm following the guide here to allow writing logs to s3.

"Use the following access policy to enable Kinesis Data Firehose to access your S3 bucket and AWS KMS key. If you don't own the S3 bucket, add s3:PutObjectAcl to the list of Amazon S3 actions. This grants the bucket owner full access to the objects delivered by Kinesis Data Firehose. "

{
"Version": "2012-10-17",  
"Statement":
[    
    {      
        "Effect": "Allow",      
        "Action": [
            "s3:AbortMultipartUpload",
            "s3:GetBucketLocation",
            "s3:GetObject",
            "s3:ListBucket",
            "s3:ListBucketMultipartUploads",
            "s3:PutObject"
        ],      
        "Resource": [        
            "arn:aws:s3:::bucket-name",
            "arn:aws:s3:::bucket-name/*"            
        ]    
    },        
    {
        "Effect": "Allow",
        "Action": [
            "kinesis:DescribeStream",
            "kinesis:GetShardIterator",
            "kinesis:GetRecords",
            "kinesis:ListShards"
        ],
        "Resource": "arn:aws:kinesis:region:account-id:stream/stream-name"
    },
    {
       "Effect": "Allow",
       "Action": [
           "kms:Decrypt",
           "kms:GenerateDataKey"
       ],
       "Resource": [
           "arn:aws:kms:region:account-id:key/key-id"           
       ],
       "Condition": {
           "StringEquals": {
               "kms:ViaService": "s3.region.amazonaws.com"
           },
           "StringLike": {
               "kms:EncryptionContext:aws:s3:arn": "arn:aws:s3:::bucket-name/prefix*"
           }
       }
    },
    {
       "Effect": "Allow",
       "Action": [
           "logs:PutLogEvents"
       ],
       "Resource": [
           "arn:aws:logs:region:account-id:log-group:log-group-name:log-stream:log-stream-name"
       ]
    },
    {
       "Effect": "Allow", 
       "Action": [
           "lambda:InvokeFunction", 
           "lambda:GetFunctionConfiguration" 
       ],
       "Resource": [
           "arn:aws:lambda:region:account-id:function:function-name:function-version"
       ]
    }
]

}

Specifically, the block I'm seeing the error on is as follows (I've included principal as this is required):

    {
        "Effect": "Allow",
        "Principal": {
            "AWS": [
                "${account_id}"
            ]
        },
        "Action": [
            "kinesis:DescribeStream",
            "kinesis:GetShardIterator",
            "kinesis:GetRecords",
            "kinesis:ListShards"
        ],
        "Resource": "arn:aws:kinesis:${region}:${account_id}:stream/*"
    },

But when I try to apply the policy to the s3 bucket, I get the following:

Error: Error putting S3 policy: MalformedPolicy: Policy has invalid action

│ status code: 400, request id: xxxxxxxxxxxxx, host id: xxxxxxxxxxxxxxxxxxxxxxxxxxxx │

Why am I getting this the error?

CodePudding user response：

The policy given in linked AWS document should be attached to IAM role associated with kinesis firehose.

S3 bucket policy is resource based policy. In resource based policy you can specify actions related to that particular resource only (S3 bucket in this case). But since you are trying to add kinesis data stream actions to S3 bucket policy, you are getting "invalid actions" error