title: InsufficientS3BucketPolicyFault when enabling AWS Redshift audit logging through Terraform
body: <h2>Problem</h2>
  <p>I'm trying to enable audit logging on an AWS redshift cluster. I've been following the instructions provided by AWS here: <a href="https://docs.aws.amazon.com/redshift/latest/mgmt/db-auditing.html#db-auditing-enable-logging" rel="nofollow noreferrer">https://docs.aws.amazon.com/redshift/latest/mgmt/db-auditing.html#db-auditing-enable-logging</a></p>
  <h2>Current Configuration</h2>
  <p>I've defined the relevant IAM role as follows</p>
  <pre><code>resource &quot;aws_iam_role&quot; &quot;example-role&quot; {
    name = &quot;example-role&quot;
  
    assume_role_policy = &lt;&lt;EOF
  {
    &quot;Version&quot;: &quot;2012-10-17&quot;,
    &quot;Statement&quot;: [
      {
        &quot;Action&quot;: &quot;sts:AssumeRole&quot;,
        &quot;Principal&quot;: {
          &quot;Service&quot;: &quot;redshift.amazonaws.com&quot;
        },
        &quot;Effect&quot;: &quot;Allow&quot;,
        &quot;Sid&quot;: &quot;&quot;
      }
    ]
  }
  EOF
  
  }
  </code></pre>
  <p>And have granted the following IAM permissions to the <code>example-role</code> role:</p>
  <pre><code>{
              &quot;Sid&quot;: &quot;AllowAccessForAuditLogging&quot;,
              &quot;Effect&quot;: &quot;Allow&quot;,
  
              &quot;Action&quot;: [
                  &quot;s3:PutObject&quot;,
                  &quot;s3:GetBucketAcl&quot;
              ],
              &quot;Resource&quot;: [
                  &quot;arn:aws:s3:::example-bucket&quot;,
                  &quot;arn:aws:s3:::example-bucket/*&quot;
              ]
          },
  </code></pre>
  <p>The relevant portion of the redshift cluster configuration is as follows:</p>
  <pre><code>resource &quot;aws_redshift_cluster&quot; &quot;example-cluster-name&quot; {
    cluster_identifier = &quot;example-cluster-name&quot;
    ...
  
    # redshift audit logging to S3
    logging {
      enable        = true
      bucket_name   = &quot;example-bucket-name&quot;
    }
  
    master_username           = var.master_username
    iam_roles                 = [aws_iam_role.example-role.arn]
    ...
  </code></pre>
  <h2>Error</h2>
  <p><code>terraform plan</code> runs correctly, and produces the expected plan based on the above configuration. However, when running <code>terraform apply</code> the following error occurs:</p>
  <pre><code>Error: error enabling Redshift Cluster (example-cluster-name) logging: InsufficientS3BucketPolicyFault: Cannot read ACLs of bucket example-bucket-name. Please ensure that your IAM permissions are set up correctly.
  </code></pre>
  <p>note: i've replaced all resource identifiers with example-* resource names and identifiers.</p>