Question: How do I troubleshoot Amazon S3 Batch Operations issues?

I want to create an Amazon Simple Storage Service (Amazon S3) Batch Operations job for objects in my bucket. However, Amazon S3 keeps returning an error or my batch job keeps failing.

Short descriptionIf an Amazon S3 Batch Operations job encounters an issue that prevents it from running successfully, then the job fails. For example, if Amazon S3 can't read the specified manifest, or objects in your manifest don't exist in the specified bucket, then the job fails. A failed job generates one or more failure codes and reasons. Amazon S3 Batch Operations stores the failure codes and reasons with the job so that you can view them by requesting the job's details. You can also review your failure codes and reasons in the completion report for the job.To prevent jobs from running a large number of unsuccessful operations, Amazon S3 also imposes a task-failure threshold on every Batch Operations job. Amazon S3 monitors the task failure rate after at least 1,000 tasks run. If a job exceeds the failure rate of 50%, then the job fails. To resolve this failure, review the causes of the failures and correct them before resubmitting the job.Here are some common reasons that Amazon S3 Batch Operations fails or returns an error:Incorrect manifest file format (.csv or JSON)The manifest file specifies multiple bucket names or contains multiple header rowsMissing permissions to read the manifest fileDifferent batch job AWS RegionMissing target bucket for your S3 Inventory reportMissing AWS Identity Access Management (IAM) role's trust policyMissing IAM role permissions for creating a batch jobMissing IAM role access to the source bucket, S3 Inventory report, or destination bucketRestrictive AWS Organizations service control policy (SCP)

ResolutionIncorrect manifest file format (.csv or JSON)Amazon S3 Batch Operations supports .csv and JSON (S3 Inventory report) manifest files. When you create a new batch job in Amazon S3, select or specify the correct manifest format for your manifest file:For the Amazon S3 Inventory report, make sure to use a CSV-formatted report. Also, specify the manifest.json file that's associated with the inventory report.For .csv files, each row in your manifest file must include the bucket name and object key. You can also include the object version. Object keys must be URL encoded. The manifest must either include version IDs for all objects or omit version IDs for all objects.Note: If the objects in your manifest are in a versioned bucket, then you must specify the version IDs for the objects. Otherwise, the batch job might fail. Or, Amazon S3 might apply the batch job to the latest version of the object, instead of the object that existed when you created the job.For more information about manifest files and formats, see Specifying a manifest.The manifest file specifies multiple bucket names or contains multiple header rowsWith S3 Batch Operations, all batch job operations require that all objects that are listed in the manifest file also exist in the same bucket. Otherwise, you receive the following error:Reasons for failure:Cannot have more than 1 bucket per Job. JOB_IDIf you perform any batch job operations, then make sure that your manifest file specifies only one bucket name. Additionally, the manifest file can't contain any header rows. For example, the following manifest file contains multiple header rows, and therefore Amazon S3 returns an error:bucket,keymy-batch-bucket,object001.txtmy-batch-bucket,object002.txtmy-batch-bucket,object003.txtmy-batch-bucket,object004.txtMissing permissions to read the manifest fileVerify that the IAM role that you use to create the S3 Batch Operations job has GetObject permissions to allow it to read the manifest file. You can do this by checking the object's metadata. Look for any mismatches in access with S3 Object Ownership. Also, look for any unsupported AWS Key Management Service (AWS KMS) keys that encrypt the manifest file.If you don't have permission to read the manifest file, then you get the following errors when you try to create an S3 Batch Operations job.See the following AWS CLI error example:Reason for failureReading the manifest is forbidden: AccessDeniedSee the following Amazon S3 console error example:Warning: Unable to get the manifest object's ETag. Specify a different object to continueNote: S3 Batch Operations supports CSV inventory reports that are AWS KMS-encrypted. S3 Batch Operations doesn't support .csv manifest files that are AWS KMS-encrypted. For more information, see Configuring inventory using the S3 console or Specifying a manifest.Different batch job RegionYou must create S3 Batch Operations copy jobs in the same Region as the destination bucket where you want to copy your objects to. Therefore, when you create your batch job, make sure to select the same Region as your destination bucket. For example, if your destination bucket is in the us-west-2 Region, then select us-west-2 as the Region for your batch job.Missing target bucket for your S3 Inventory reportConfirm that the target bucket for your S3 Inventory report exists. Also, confirm that the S3 bucket policy doesn't deny the s3:PutObject action. If the report is delivered to another AWS account, then confirm that the target bucket allows the IAM role to perform the s3:PutObject action.Missing IAM role's trust policyNote: Make sure that you specifying an IAM role and not an IAM user.Unlike an IAM user, an IAM role has a trust policy that defines which conditions must be met for other principals to assume it. To allow the S3 Batch Operations service principal to assume the IAM role, attach a trust policy to the role.The following example trust policy delegates access to Amazon S3 and reduces any risks that are associated with privilege escalation:{  "Version": "2012-10-17",  "Statement": [    {      "Effect": "Allow",      "Principal": {        "Service": "batchoperations.s3.amazonaws.com"      },      "Action": "sts:AssumeRole"    }  ]}Missing IAM permissions for creating a batch jobBefore you create and run S3 Batch Operations jobs, grant the required permissions. If your IAM role is missing the required permissions to perform the S3 Batch Operations job, then the batch job fails.To create an S3 Batch Operations job, you must grant s3:CreateJob permissions. The same entity that creates the job must also have iam:PassRole permissions to pass the IAM role that's specified for the batch job. For more information about specifying IAM resources, see IAM JSON policy elements: Resource .Missing IAM role access to the source bucket, S3 Inventory report, or destination bucketCheck to make sure that the IAM role that you use for S3 Batch Operations has the required permissions to perform the batch job. For example, the IAM policy for the copy operation looks like the following example:{  "Version": "2012-10-17",  "Statement": \[    {      "Action": \[        "s3:PutObject",        "s3:PutObjectAcl",        "s3:PutObjectTagging"      \],      "Effect": "Allow",      "Resource": "arn:aws:s3:::{{DestinationBucket}}/\*"    },    {      "Action": \[        "s3:GetObject",        "s3:GetObjectAcl",        "s3:GetObjectTagging",        "s3:ListBucket"      \],      "Effect": "Allow",      "Resource": \[        "arn:aws:s3:::{{SourceBucket}}",        "arn:aws:s3:::{{SourceBucket}}/\*"      \]    },    {      "Effect": "Allow",      "Action": \[        "s3:GetObject",        "s3:GetObjectVersion"      \],      "Resource": \[        "arn:aws:s3:::{{ManifestBucket}}/\*"      \]    },    {      "Effect": "Allow",      "Action": \[        "s3:PutObject"      \],      "Resource": \[        "arn:aws:s3:::{{ReportBucket}}/\*"      \]    }  \]}For more information, see Granting permissions for Amazon S3 Batch Operations.Restrictive AWS Organizations SCPIf you use AWS Organizations, then confirm that there aren't any deny statements that might deny access to Amazon S3. For example, if your service control policy explicitly denies all S3 actions, then you might get an Access Denied error when you create a batch job.See the following example policy that explicitly denies all S3 actions:{  "Version": "2012-10-17",  "Statement": [    {      "Principal": "*",      "Effect": "Deny",      "Action": "s3:*",      "Resource": "*"    }  ]}If you intend to apply a restrictive policy, then you can allowlist the IAM role that S3 Batch Operations uses to perform the operation. See the following example:{  "Version": "2012-10-17",  "Statement": [    {      "Principal": "*",      "Effect": "Deny",      "Action": "s3:*",      "Resource": "*",      "Condition": {        "StringNotLike": {          "aws:userId": [            "AROAEXAMPLEID:*",            "AIDAEXAMPLEID",            "111111111111"          ]        }      }    }  ]}