S3 Action Connector fails in both Chat and Automate Workflows despite "Ready" status & IAM permissions

Q&A
, , , , , ,
1

Hi everyone,

I am encountering a complete failure with the S3 Action Connector across all execution environments in Amazon Quick.

The connector was successfully configured, shows a “Ready” status, and can be selected in the Chat interface as well as integrated into Quick Automate workflows. However, executing S3 actions fails in both cases (neither Chat prompts nor automated workflow steps are able to complete the operations).

Environment & Configuration

  • Service: Amazon Quick (Enterprise Plan)
  • Connector: S3 Connector (Amazon S3) — Status: Ready
  • Enabled Actions: 10/10 (including PutObject, GetObject, ListBuckets, ListObjectsV2, AbortMultipartUpload)
  • Integration Status: Successfully added to both Chat integrations and Quick Automate flows.
  • Target Bucket: Standard S3 bucket in the same account (SSE-S3 default encryption, no custom KMS, Public Access enabled, no explicit Deny in Bucket Policy).
  • Management: Configured via Manage QuickSight → Security & permissions.

IAM Policy attached to the Service Role (aws-quicksight-service-role-v0)

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": "s3:ListAllMyBuckets",
            "Resource": "arn:aws:s3:::*"
        },
        {
            "Action": ["s3:ListBucket"],
            "Effect": "Allow",
            "Resource": ["arn:aws:s3:::my-target-bucket"]
        },
        {
            "Action": ["s3:GetObject", "s3:GetObjectVersion"],
            "Effect": "Allow",
            "Resource": ["arn:aws:s3:::my-target-bucket/*"]
        },
        {
            "Action": ["s3:ListBucketMultipartUploads", "s3:GetBucketLocation"],
            "Effect": "Allow",
            "Resource": ["arn:aws:s3:::my-target-bucket"]
        },
        {
            "Effect": "Allow",
            "Action": ["s3:PutObject", "s3:AbortMultipartUpload", "s3:ListMultipartUploadParts"],
            "Resource": ["arn:aws:s3:::my-target-bucket/*"]
        }
    ]
}

Observed Behavior

  1. Chat Session: The connector is enabled and selectable in the footer, but asking the agent to perform S3 operations (like listing or uploading files) results in the agent claiming no S3 integration is available or failing during execution.

  2. Automate Workflows: The connector can be added as a step inside Quick Automate flows, but when the workflow triggers, the step fails to execute the S3 operation.

Questions for the Community

  1. Does the S3 Action Connector require specific Trust Policy relationships on the IAM role (e.g., explicitly allowing q.amazonaws.com alongside quicksight.amazonaws.com) to execute actions at runtime?

  2. Is there a global workspace setting or policy toggle in the Admin Console required to enable Action Connectors for both Chat and Automate?

  3. Has anyone experienced a similar issue where an Action Connector is marked as “Ready” and assignable in workflows, but fails to execute actions in any context?

Any insights or troubleshooting recommendations would be greatly appreciated!

Quick Troubleshooting
Quick Troubleshooting1854×823 92.6 KB

2

Hi @AlejandroT

Thank you for the detailed write-up.

Trust Policy Requirements: Yes, the S3 Action Connector requires a dedicated IAM role (separate from aws-quicksight-service-role-v0) with a trust policy that explicitly allows quicksight.amazonaws.com to assume it. You would attach your S3 permissions to this new role, and then provide its ARN during the Action Connector creation process.

Admin Console Configuration: AWS Service Action Connectors must be created through a specific admin path: Manage Quick Suite -> AWS actions (under Permissions) -> New Action. The configuration under Security & permissions that you referenced is intended for data-access integrations (dashboards/knowledge bases), not for action execution. Once created, the connector also needs to be shared with users/groups and added to an Automation Group to be usable in workflows.

Ready Status but Failing to Execute: This behavior is consistent with having configured the S3 data-access integration (via Security & permissions) rather than the S3 Action Connector (via AWS actions). Additionally, please note that AWS service action connectors are only supported within Quick Automate workflows, they are not designed to execute from Chat, even if they appear selectable in the interface.

Please refer to the following documentation, which might be helpful for you.