Grant a Compute Service Access to an S3 Bucket

Your compute service (EC2, Lambda, or ECS) is connected to an S3 bucket on the canvas, but the IAM role attached to it has no s3:* permissions. The template will deploy, but the connection fails at runtime with AccessDenied. The simplest fix is on the canvas: with the compute→bucket edge in place, let CloudStack Canvas generate a scoped policy for the auto-created role. If you are managing your own IAM Role node, add the S3 actions to it yourself using the steps below.

Paste into this field

IAM Role → permissions policy (or draw the edge on the canvas)

Output looks like

Canvas edge: EC2 → S3 (auto-generates an s3:GetObject/PutObject policy)

1Option A (recommended) — let CloudStack Canvas generate it

If you do not have a custom IAM Role node on the canvas, simply remove it and re-draw the edge from your compute service to the S3 bucket. CSC auto-creates a role with a least-privilege policy scoped to that bucket. Re-open Export and the warning is gone.

3Option B — fix the role in the AWS console and accept the warning

If you manage your own IAM Role node on the canvas, the validation warning will persist in CSC even after you add the policy in AWS. The warning is advisory — it alerts you that the canvas role node lacks these permissions. Add the policy below in AWS, and the template will deploy correctly; the canvas warning remains until you edit the canvas-based role definition.

5Create an inline policy

Click "Add permissions" → "Create inline policy" → the JSON tab. Paste the policy below, replacing my-bucket with your bucket name. The two resource ARNs are required: the bucket itself (for ListBucket) and its objects (for Get/Put).

{
  "Version": "2012-10-17",
  "Statement": [{
    "Effect": "Allow",
    "Action": ["s3:GetObject", "s3:PutObject", "s3:ListBucket"],
    "Resource": [
      "arn:aws:s3:::my-bucket",
      "arn:aws:s3:::my-bucket/*"
    ]
  }]
}

8Save the policy

Name it something like AllowS3Access and click "Create policy". The role now has the permissions; no value needs pasting back into CloudStack Canvas.

Once you have the value, go back to CloudStack Canvas and paste it into the highlighted field.

CloudStack Canvas · Validation Guide