# \[s3\_repository\] path is not accessible on master node

**URL:** https://discuss.elastic.co/t/s3-repository-path-is-not-accessible-on-master-node/111570
**Category:** Elasticsearch
**Created:** [December 13, 2017, 1:53pm UTC](https://discuss.elastic.co/t/s3-repository-path-is-not-accessible-on-master-node/111570 "2017-12-13T13:53:19Z")
**Posts on this page:** 3
**Page:** 1

<div class="post-metadata">

### Author: ![clk2018](https://avatars.discourse-cdn.com/v4/letter/c/4491bb/32.png) [@clk2018](https://discuss.elastic.co/u/clk2018)
#### Post date: [December 13, 2017, 1:53pm UTC](https://discuss.elastic.co/t/s3-repository-path-is-not-accessible-on-master-node/111570/1 "2017-12-13T13:53:19Z")

</div>

My EC2 elasticsearch 2.4.6 cluster (hosted on amazon east data center) is having issues with the aws-cloud 2.4.6 plugin, I have configured my elasticsearch.yml file as instructed by configuration .  
cloud:  
aws:  
access\_key: XXX  
secret\_key: XXX  
The S3 bucket is set up to have s3Full access.  
I did a testing before my elasticsearch cluster upgrade, which was 1.7.6 version using aws-cloud plugin from this documentation -[https://github.com/elastic/elasticsearch-cloud-aws](https://github.com/elastic/elasticsearch-cloud-aws). The snapshot and restore process was working perfectly fine until recently I upgraded my ES version to 2.4.6.

Here's the curl script I usually use to create s3\_repository. PS, I can manually upload files to the s3 bucket using aws cli.

> ```
> { ~ } » curl -XPUT 'http://localhost:10557/_snapshot/s3_repository?pretty' -H 'Content-Type: application/json' -d' ~
> {
> "type": "s3",
> "settings": {
> "bucket": "my-bucket",
> "region": "us-east",
> "access_key": "XXX",
> \"secret_key": "XXX"
> }
> } '
> 
> ```

> {  
> "error" : {  
> "root\_cause" : [ {  
> "type" : "amazon\_s3\_exception",  
> "reason" : "amazon\_s3\_exception: Access Denied (Service: Amazon S3; Status Code: 403; Error Code: AccessDenied; Request ID: 3906E3E1E996060C)"  
> } ],  
> "type" : "repository\_verification\_exception",  
> "reason" : "[s3\_repository] path is not accessible on master node",  
> "caused\_by" : {  
> "type" : "i\_o\_exception",  
> "reason" : "i\_o\_exception: com.amazonaws.services.s3.model.AmazonS3Exception: Access Denied (Service: Amazon S3; Status Code: 403; Error Code: AccessDenied; Request ID: 3906E3E1E996060C), S3 Extended Request ID: Q/OWbf2aljoROoeLB48dfZ8YqBKzKw5JaQvpxrHwXXd4WT4qUp5nlHs8fCWKV19dIrCPXtW6Clo=",  
> "caused\_by" : {  
> "type" : "amazon\_s3\_exception",  
> "reason" : "amazon\_s3\_exception: Access Denied (Service: Amazon S3; Status Code: 403; Error Code: AccessDenied; Request ID: 3906E3E1E996060C)"  
> }  
> }  
> },  
> "status" : 500  
> }

And in my s3 bucket, there is a test folder created but not the s3\_repository.

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/6/c/6c0a78d281e492b6b3e25dca324f6486e9e032ff.png)

Is anyone else having similar issues ?

My S3 policy was configured by a guy from aws admin team.

> {  
> "Statement": [  
> {  
> "Action": [  
> "s3:ListBucket",  
> "s3:GetBucketLocation",  
> "s3:ListBucketMultipartUploads",  
> "s3:ListBucketVersions"  
> ],  
> "Effect": "Allow",  
> "Resource": [  
> "arn:aws:s3:::BUCKET-NAME"  
> ]  
> },  
> {  
> "Action": [  
> "s3:GetObject",  
> "s3:PutObject",  
> "s3:AbortMultipartUpload",  
> "s3:ListMultipartUploadParts"  
> ],  
> "Effect": "Allow",  
> "Resource": [  
> "arn:aws:s3:::BUCKET-NAME",  
> "arn:aws:s3:::BUCKET-NAME/\*"  
> ]  
> }  
> ],  
> "Version": "2012-10-17"  
> }

---

<div class="post-metadata">

### Author: ![clk2018](https://avatars.discourse-cdn.com/v4/letter/c/4491bb/32.png) [@clk2018](https://discuss.elastic.co/u/clk2018)
#### Post date: [December 13, 2017, 7:54pm UTC](https://discuss.elastic.co/t/s3-repository-path-is-not-accessible-on-master-node/111570/2 "2017-12-13T19:54:56Z")

</div>

I have solved this issue myself, the issue is with the way policy is set up.

```
{
  "Statement": [
    {
      "Action": [
        "s3:ListBucket",
        "s3:GetBucketLocation",
        "s3:ListBucketMultipartUploads",
        "s3:ListBucketVersions"
      ],
      "Effect": "Allow",
      "Resource": [
        "arn:aws:s3:::BUCKET-NAME"
      ]
    },
    {
      "Action": [
        "s3:GetObject",
        "s3:PutObject",
        "s3:DeleteObject",
        "s3:AbortMultipartUpload",
        "s3:ListMultipartUploadParts"
      ],
      "Effect": "Allow",
      "Resource": [
         "arn:aws:s3:::BUCKET-NAME/*"
      ]
    }
  ],
  "Version": "2012-10-17"
}

```

Previously, our aws admin removed the "s3:DeleteObject" from the action list.

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [January 10, 2018, 7:55pm UTC](https://discuss.elastic.co/t/s3-repository-path-is-not-accessible-on-master-node/111570/3 "2018-01-10T19:55:25Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.