Hi @priyanka1
This is a common scenario where a Chat Agent with an S3-based knowledge base works for the creator but fails for shared users. In Quick, access to the Agent, the Knowledge Base, and the underlying S3 integration are managed separately — all three need to be explicitly shared. Here’s what I’d recommend checking:
1) Verify the Knowledge Base is explicitly shared with the client: Sharing the Chat Agent and Space does not automatically share the underlying Knowledge Base. Only the KB creator can share it. Navigate to Knowledge bases → select the S3 knowledge base used by the agent → choose Share → add your client with at least Viewer access. (Based on your statement, I believe you have already done this!)
2) Check the “Restrict bucket access to knowledge base creator” admin setting: When the S3 integration was configured in the Quick admin console, there’s an option — “Restrict bucket access to knowledge base creator.” If this is enabled, only the user who originally created the KB can query the S3 bucket, even if the agent and space are shared with full owner access. Ask your Quick administrator (or) go to Admin Console → Permissions → AWS Resources → Amazon S3 and verify this checkbox is unchecked for the relevant bucket. Refer to Administrator setup.
3) Verify IAM policy assignments for the client: Quick supports IAM policy assignments that control which S3 buckets specific users can access. These take precedence over the general AWS resource-level permissions. In the admin console, go to Permissions → IAM policy assignments and verify your client’s user or group has been granted access to the specific S3 bucket used by the KB.
4) Confirm S3 bucket permissions at the AWS level: The Quick service role (aws-quicksight-service-role-v0) needs minimum permissions on the bucket — s3:GetObject, s3:ListBucket, s3:GetBucketLocation, s3:GetObjectVersion. If the bucket uses KMS encryption, the service role also needs kms:Decrypt and kms:DescribeKey on the KMS key. Refer to S3 integration troubleshooting.
5) Re-sync the knowledge base: After confirming/adjusting the above permissions, trigger a fresh KB sync (refresh) to ensure the updated permissions take effect.
The most likely culprits for your scenario (works for creator, fails for shared users) are #1 and #2. I’d recommend checking those first.
If the issue persists after these steps, I’d recommend creating an AWS Support ticket with the specific error messages your client is seeing, so the support team can investigate the account-level configuration.