title: Why am I getting an the following error? "Error putting S3 policy: MalformedPolicy: Policy has invalid action"
body: <p>I'm following the guide <a href="https://docs.aws.amazon.com/firehose/latest/dev/controlling-access.html" rel="nofollow noreferrer">here</a> to allow writing logs to s3.</p>
  <p>&quot;Use the following access policy to enable Kinesis Data Firehose to access your S3 bucket and AWS KMS key. If you don't own the S3 bucket, add s3:PutObjectAcl to the list of Amazon S3 actions. This grants the bucket owner full access to the objects delivered by Kinesis Data Firehose. &quot;</p>
  <pre><code>{
  &quot;Version&quot;: &quot;2012-10-17&quot;,  
  &quot;Statement&quot;:
  [    
      {      
          &quot;Effect&quot;: &quot;Allow&quot;,      
          &quot;Action&quot;: [
              &quot;s3:AbortMultipartUpload&quot;,
              &quot;s3:GetBucketLocation&quot;,
              &quot;s3:GetObject&quot;,
              &quot;s3:ListBucket&quot;,
              &quot;s3:ListBucketMultipartUploads&quot;,
              &quot;s3:PutObject&quot;
          ],      
          &quot;Resource&quot;: [        
              &quot;arn:aws:s3:::bucket-name&quot;,
              &quot;arn:aws:s3:::bucket-name/*&quot;            
          ]    
      },        
      {
          &quot;Effect&quot;: &quot;Allow&quot;,
          &quot;Action&quot;: [
              &quot;kinesis:DescribeStream&quot;,
              &quot;kinesis:GetShardIterator&quot;,
              &quot;kinesis:GetRecords&quot;,
              &quot;kinesis:ListShards&quot;
          ],
          &quot;Resource&quot;: &quot;arn:aws:kinesis:region:account-id:stream/stream-name&quot;
      },
      {
         &quot;Effect&quot;: &quot;Allow&quot;,
         &quot;Action&quot;: [
             &quot;kms:Decrypt&quot;,
             &quot;kms:GenerateDataKey&quot;
         ],
         &quot;Resource&quot;: [
             &quot;arn:aws:kms:region:account-id:key/key-id&quot;           
         ],
         &quot;Condition&quot;: {
             &quot;StringEquals&quot;: {
                 &quot;kms:ViaService&quot;: &quot;s3.region.amazonaws.com&quot;
             },
             &quot;StringLike&quot;: {
                 &quot;kms:EncryptionContext:aws:s3:arn&quot;: &quot;arn:aws:s3:::bucket-name/prefix*&quot;
             }
         }
      },
      {
         &quot;Effect&quot;: &quot;Allow&quot;,
         &quot;Action&quot;: [
             &quot;logs:PutLogEvents&quot;
         ],
         &quot;Resource&quot;: [
             &quot;arn:aws:logs:region:account-id:log-group:log-group-name:log-stream:log-stream-name&quot;
         ]
      },
      {
         &quot;Effect&quot;: &quot;Allow&quot;, 
         &quot;Action&quot;: [
             &quot;lambda:InvokeFunction&quot;, 
             &quot;lambda:GetFunctionConfiguration&quot; 
         ],
         &quot;Resource&quot;: [
             &quot;arn:aws:lambda:region:account-id:function:function-name:function-version&quot;
         ]
      }
  ]
  </code></pre>
  <p>}</p>
  <p>Specifically, the block I'm seeing the error on is as follows (I've included principal as this is required):</p>
  <pre><code>    {
          &quot;Effect&quot;: &quot;Allow&quot;,
          &quot;Principal&quot;: {
              &quot;AWS&quot;: [
                  &quot;${account_id}&quot;
              ]
          },
          &quot;Action&quot;: [
              &quot;kinesis:DescribeStream&quot;,
              &quot;kinesis:GetShardIterator&quot;,
              &quot;kinesis:GetRecords&quot;,
              &quot;kinesis:ListShards&quot;
          ],
          &quot;Resource&quot;: &quot;arn:aws:kinesis:${region}:${account_id}:stream/*&quot;
      },
  </code></pre>
  <p>But when I try to apply the policy to the s3 bucket, I get the following:</p>
  <pre><code>Error: Error putting S3 policy: MalformedPolicy: Policy has invalid action
  </code></pre>
  <p>│   status code: 400, request id: xxxxxxxxxxxxx, host id: xxxxxxxxxxxxxxxxxxxxxxxxxxxx
  │</p>
  <p>Why am I getting this the error?</p>