title: How to fix AWS Config generating AccessDenied error?
body: <p>I am trying to allow AWS Config to write to a non-public S3 bucket.</p>
  
  <p>Based on <a href="https://docs.aws.amazon.com/config/latest/developerguide/iamrole-permissions.html" rel="nofollow noreferrer">the official documentation</a>, I should have two policies assigned to the AWS role. However, It is not possible to add any policy to the service-linked role, neither to create a custom new service-linked role for AWS config.</p>
  
  <p><a href="https://i.stack.imgur.com/Z8gNH.jpg" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/Z8gNH.jpg" alt="AWS Policy"></a>
  As such, how can I stop receiving the S3 AccessDenied error without making the bucket public?</p>
  
  <p>edit: here is the error log:</p>
  
  <pre><code>{
  "eventVersion": "1.07",
  "userIdentity": {
      "type": "AssumedRole",
      "principalId": "xxxxxxxxxxxxxxxxxxxxx:AWSConfig-BucketConfigCheck",
      "arn": "arn:aws:sts::xxxxxxxxxxxx:assumed-role/AWSServiceRoleForConfig/AWSConfig-BucketConfigCheck",
      "accountId": "xxxxxxxxxxxx",
      "accessKeyId": "xxxxxxxxxxxxxxxxxxxx",
      "sessionContext": {
          "sessionIssuer": {
              "type": "Role",
              "principalId": "xxxxxxxxxxxxxxxxxxxxx",
              "arn": "arn:aws:iam::xxxxxxxxxxxx:role/aws-service-role/config.amazonaws.com/AWSServiceRoleForConfig",
              "accountId": "xxxxxxxxxxxx",
              "userName": "AWSServiceRoleForConfig"
          },
          "attributes": {
              "creationDate": "2020-04-30T00:43:57Z",
              "mfaAuthenticated": "false"
          }
      },
      "invokedBy": "AWS Internal"
  },
  "eventTime": "2020-04-30T00:43:57Z",
  "eventSource": "s3.amazonaws.com",
  "eventName": "PutObject",
  "awsRegion": "eu-west-1",
  "sourceIPAddress": "xxx.xxx.xxx.xxx",
  "userAgent": "[AWSConfig]",
  "errorCode": "AccessDenied",
  "errorMessage": "Access Denied",
  "requestParameters": {
      "bucketName": "aws-config-bucket-xxxxxxxxxxxx",
      "Host": "aws-config-bucket-xxxxxxxxxxxx.s3.eu-west-1.amazonaws.com",
      "x-amz-acl": "bucket-owner-full-control",
      "x-amz-server-side-encryption": "AES256",
      "key": "AWSLogs/xxxxxxxxxxxx/Config/ConfigWritabilityCheckFile"
  },
  "responseElements": null,
  "additionalEventData": {
      "SignatureVersion": "SigV4",
      "CipherSuite": "ECDHE-RSA-AES128-SHA",
      "bytesTransferredIn": 0,
      "AuthenticationMethod": "AuthHeader",
      "x-amz-id-2": "xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx=",
      "bytesTransferredOut": 243
  },
  "requestID": "xxxxxxxxxxxxxxxx",
  "eventID": "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx",
  "readOnly": false,
  "resources": [
      {
          "type": "AWS::S3::Object",
          "ARN": "arn:aws:s3:::aws-config-bucket-xxxxxxxxxxxx/AWSLogs/xxxxxxxxxxxx/Config/ConfigWritabilityCheckFile"
      },
      {
          "accountId": "xxxxxxxxxxxx",
          "type": "AWS::S3::Bucket",
          "ARN": "arn:aws:s3:::aws-config-bucket-xxxxxxxxxxxx"
      }
  ],
  "eventType": "AwsApiCall",
  "managementEvent": false,
  "recipientAccountId": "xxxxxxxxxxxx",
  "vpcEndpointId": "vpce-xxxxxxxx",
  "eventCategory": "Data"
  </code></pre>
  
  <p>}</p>