更新Timestream表MagneticStoreRejectedDataLocation所需S3权限及问题排查

我想要为Timestream表配置磁存储写入，并指定了一个S3桶，该桶应允许配置Timestream表设置的账户写入。我已通过上传测试文件验证自己的AWS账户可写入该桶，但保存设置时却报错：

"The S3 bucket [xxxxxxxxx] doesn't exist, or you don't have sufficient permission to access it, or it does not belong to your account."

桶当前配置 #

• 启用阻止公共访问
• 桶ACL所有权设置为 "ObjectWriter"

已附加的S3桶策略 #

我已尝试为该S3桶附加策略，允许主体AWS账户、timestream.amazonaws.com、AWSBackupDefaultServiceRole和AWSServiceRoleForBackup对指定桶执行对应S3操作，策略内容如下：

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "BackupAllowWriteToS3ErrorLogs",
            "Effect": "Allow",
            "Principal": {
                "AWS": [
                    "arn:aws:iam::{AWS_ACCOUNT}:role/service-role/AWSBackupDefaultServiceRole",
                    "arn:aws:iam::{AWS_ACCOUNT}:role/aws-service-role/backup.amazonaws.com/AWSServiceRoleForBackup"
                ]
            },
            "Action": "s3:PutObject",
            "Resource": [
                "arn:aws:s3:::my-error-logs",
                "arn:aws:s3:::my-error-logs/*"
            ]
        },
        {
            "Sid": "DeveloperAccountAllowWriteToS3ErrorLogs",
            "Effect": "Allow",
            "Principal": {
                "AWS": "arn:aws:iam::{AWS_ACCOUNT}:root"
            },
            "Action": "s3:*",
            "Resource": [
                "arn:aws:s3:::my-error-logs",
                "arn:aws:s3:::my-error-logs/*"
            ]
        },
        {
            "Sid": "TimestreamAllowWriteToS3ErrorLogs",
            "Effect": "Allow",
            "Principal": {
                "Service": "timestream.amazonaws.com"
            },
            "Action": "s3:*",
            "Resource": [
                "arn:aws:s3:::my-error-logs",
                "arn:aws:s3:::my-error-logs/*"
            ]
        }
    ]
}

额外配置的Backup角色策略 #

因最初备份恢复时遇到问题，我在AWSBackupDefaultServiceRole中创建了以下允许对该桶执行基础S3操作的策略，但该角色的“权限策略”中显示此策略的附加实体数为0，尽管策略已存在：

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "VisualEditor0",
            "Effect": "Allow",
            "Action": [
                "s3:PutObject",
                "s3:GetObject",
                "s3:ListBucket"
            ],
            "Resource": "arn:aws:s3:::my-error-logs"
        }
    ]
}

我的疑问 #

• 通过AWS控制台更新该Timestream表时会使用哪个角色？
• 除Timestream外，还有哪些角色需要具备该桶的写入权限？
• 我需要如何配置才能解决此问题？

内容的提问来源于stack exchange，提问作者Nate Reed