# S3 input plugin is not reading AWS-KMS (CMK) encrypted bucket

**URL:** <https://discuss.elastic.co/t/s3-input-plugin-is-not-reading-aws-kms-cmk-encrypted-bucket/249199>\
**Category:** Logstash\
**Created:** [September 19, 2020, 6:38am UTC](https://discuss.elastic.co/t/s3-input-plugin-is-not-reading-aws-kms-cmk-encrypted-bucket/249199 "2020-09-19T06:38:18Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![deepanshumarwah](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/deepanshumarwah/32/74281_2.png) [@deepanshumarwah](https://discuss.elastic.co/u/deepanshumarwah)\
**Post date:** [September 19, 2020, 6:38am UTC](https://discuss.elastic.co/t/s3-input-plugin-is-not-reading-aws-kms-cmk-encrypted-bucket/249199/1 "2020-09-19T06:38:18Z")

</div>

Hi All

I am running a logstash container with s3 pipeline as per below configuration:

```
input {
  s3 {
    id => "pipeline_s3_example_bucket_input"
    bucket => "example-bucket"
    region => "ap-southeast-1"
    access_key_id => "#######################"
    secret_access_key => "#######################"
    codec => "json_lines"
    sincedb_path => "/sincedbs/pipeline_s3_example_bucket.sincedb"
    prefix => "folderA"
    add_field => {
      "type" => "example-bucket-logs"
      "host" => "example-bucket"
    }
  }
}

```

My s3 bucket is encrypted with AWS-KMS using a custom managed key. I am using below IAM policy for user to read the bucket data :

```
{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "IAMPolicy",
            "Effect": "Allow",
            "Action": [
                "s3:GetObject",
                "kms:Decrypt",
                "s3:GetBucketLogging",
                "kms:GenerateDataKey",
                "kms:DescribeKey",
                "s3:GetObjectTagging",
                "s3:ListBucket",
                "s3:GetBucketVersioning",
                "s3:GetBucketLocation",
                "s3:GetObjectVersion"
            ],
            "Resource": [
                "arn:aws:kms:ap-southeast-1:<account-id>:key/<Key-ID>",
                "arn:aws:s3:::example-bucket",
                "arn:aws:s3:::example-bucket/*"
            ]
        }
    ]
}

```

I also added the user arn in the Key users, I tested the access using aws cli commands and that worked as well. However, logstash is not able to pull those logs and I cant see any error in container logs as well. Please help if anyone else has faced similar issue.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [October 17, 2020, 6:38am UTC](https://discuss.elastic.co/t/s3-input-plugin-is-not-reading-aws-kms-cmk-encrypted-bucket/249199/2 "2020-10-17T06:38:26Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.