Unable to register cloud store as Big Data File Share in Portal for ArcGIS

Error Message

Unable to register AWS Cloud Store (S3 Bucket) as a Big Data File Share. However the same bucket is getting registered as cloud store in Portal for ArcGIS and ArcGIS Server Manager. The following error message is returned:

Invalid folder location. Unable to access this location.

Cause

There are two possible causes for this issue:

• Invalid SSL Certificate: An invalid or misconfigured SSL certificate caused secure communication failures due to trust or validation issues.
• Custom Policy and Identity and Access Management (IAM) Role Issue: Incorrect custom IAM policy and role configuration in the AWS Management Console resulted in authorization and access issues for required services.
   

Solution or Workaround

Configure the AWS IAM permissions and register an Amazon S3 bucket as Cloud Storage and a Big Data File Share in Portal for ArcGIS

1. Check the IAM role policy. Check Custom Policy on the AWS Management Console.
2. Make sure ArcGIS Enterprise has a valid SSL Certificate, and the environment is secured.
3. Make the changes in the AWS Management Console. Create one user and modify permissions in the Policy editor, as shown in the next image.
   1. Go to the AWS Console.
   2. In IAM, under Users, create one user.
   3. Go to the Permissions tab. The custom policy should be attached to the user.
      A customer-managed policy named "testpolicy" is attached directly to the IAM user. The policy is not inherited from a group, it is explicitly attached to the user. No permissions boundary is set, which means the attached policy fully defines the user’s permissions. This confirms that the IAM user has the required S3 permissions through a custom policy. The IAM user must have explicit permissions to access the required S3 bucket for ArcGIS Enterprise.

4. Modify permissions in the json editor, as shown in the next image.
   • s3:GetBucketAcl is mandatory for registering the S3 bucket as a Big  Data File Share in ArcGIS. Without this permission, the Big Data File Share registration fails, even if Cloud Storage registration succeeds.

5. In the json (Policy) editor, enter the following json:

{  
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "s3:GetObject",
        "s3:ListBucket",
        "s3:PutObject",
        "s3:GetBucketAcl"
      ],
      "Resource": [
        "arn:aws:s3:::bucket_name",
        "arn:aws:s3:::bucket_name/*"
      ]
    }
  ]
} 

6. Generate Access Keys (IAM user only):
   1. Open IAM and go to Users > <user_name> > Security credentials.
   2. Click Create access key.
   3. Make a note of Access Key ID and the Secret Access Key.
7. Navigate to Portal for ArcGIS: Content > New Item > Datastore.
   Once the AWS S3 Bucket is registered as cloud storage, register it as Big Data File Share, as shown in the next image.

Note:
• If the user wants the IAM role, the custom policy must be attached to the IAM role (EC2-role) in the account where ArcGIS Enterprise is deployed.
• GetBucketAcl is required for a Big Data File Share.