Cannot create S3 bulk export destination - KMS GenerateDataKey error

LangSmith Product Help Observability & Evals
1

Hi all,

When trying to create a new S3 bulk export destination using the API, I’m getting a KMS permission error even though my S3 bucket doesn’t use KMS encryption.

400 Bad Request - POST https://api.smith.langchain.com/api/v1/bulk-exports/destinations

{
“detail”: “Failed to validate S3 destination: User: arn:aws:sts::XXXX:assumed-role/AWSReservedSSO_AdministratorAccess_XXX/user@example.com is not authorized to perform: kms:GenerateDataKey on this resource because the resource does not exist in this Region, no resource-based policies allow access, or a resource-based policy explicitly denies access”
}

I verified the following about my bucket that it exists in right region, the encryption is SSE-S3 (AES256), NOT KMS, no bucket policy exists, and AWS managed KMS key (alias/aws/s3) exists in my account.

2

Can you share your invocation (With redacted creds)?

And can you also try invoking with the new parameter "include_bucket_in_prefix": true?

Error when trying to create a destination for bulk export
3

Tried it with the new parameter and it worked, thank you!

1 Like