AWS AccessDeniedException elastictranscoder:CreateJob

Question

I'm trying to use a Lambda function to trigger an Elastic Transcoder job, but I keep getting this error message:

AccessDeniedException: User: arn:aws:sts::xxx:assumed-role/xxxx/xxx is not authorized to perform: elastictranscoder:CreateJob on resource: arn:aws:elastictranscoder:xxxxx:pipeline/xxxxx

My IAM user policy covers all access requirements:

{
"Version": "2012-10-17",
"Statement": [
    {
        "Sid": "Stmt1465486106000",
        "Effect": "Allow",
        "Action": [
            "logs:CreateLogGroup",
            "logs:CreateLogStream",
            "logs:GetLogEvents",
            "logs:PutLogEvents",
            "logs:DescribeLogStreams"
        ],
        "Resource": [
            "arn:aws:logs:*:*:*"
        ]
    },
    {
        "Sid": "1",
        "Effect": "Allow",
        "Action": [
            "s3:Put*",
            "s3:ListBucket",
            "s3:*MultipartUpload*",
            "s3:Get*"
        ],
        "Resource": "*"
    },
    {
        "Sid": "2",
        "Effect": "Allow",
        "Action": "sns:Publish",
        "Resource": "*"
    },
    {
        "Sid": "3",
        "Effect": "Deny",
        "Action": [
            "s3:*Delete*",
            "s3:*Policy*",
            "sns:*Remove*",
            "sns:*Delete*",
            "sns:*Permission*"
        ],
        "Resource": "*"
    }
]
}

Why am I getting the AccessDeniedException and how can I fix it?

Answer 1

Change your policy to below and then try it will work

{
"Version": "2012-10-17",
"Statement": [
    {
        "Sid": "Stmt1465486106000",
        "Effect": "Allow",
        "Action": [

            "logs:CreateLogGroup",
            "logs:CreateLogStream",
            "logs:GetLogEvents",
            "logs:PutLogEvents",
            "logs:DescribeLogStreams"
        ],
        "Resource": [
            "arn:aws:logs:*:*:*"
        ]
    },
    {
        "Sid": "1",
        "Effect": "Allow",
        "Action": [
            "elastictranscoder:*",
            "s3:Put*",
            "s3:ListBucket",
            "s3:*MultipartUpload*",
            "s3:Get*"
        ],
        "Resource": "*"
    },
    {
        "Sid": "2",
        "Effect": "Allow",
        "Action": "sns:Publish",
        "Resource": "*"
    },
    {
        "Sid": "3",
        "Effect": "Deny",
        "Action": [
            "s3:*Delete*",
            "s3:*Policy*",
            "sns:*Remove*",
            "sns:*Delete*",
            "sns:*Permission*"
        ],
        "Resource": "*"
    }
]
}