Hi Team, while doing file carving, some times these are getting failed with below error logged in osquery for the last block upload. As intermittently these carving succeed, doesnot look to me like a configuration issue. Any pointers here? { "message": "save block data: s3 multipart carve upload: AccessDenied: Access Denied\n\tstatus code: 403, request id: XXXX, host id: ~XXXXX~", "errors": [ { "name": "base", "reason": "save block data: s3 multipart carve upload: AccessDenied: Access Denied\n\tstatus code: 403, request id: XXXXX, host id: ~XXXX~" } ] }

Hi @Anoop K V! I've reached out to the team for input and will get back to you as soon as I've got more info.

@Kathy Satterlee FYI, after I added following action to the IAM policy permissions in the Action field, "s3-object-lambda:*" I have not faced the above issue till now. Hopefully that continues.