Error: F_JG290D AccessDenied for GetBucketLocation

Issue

When configuring a Databricks target location with Amazon S3 as the Integrate Staging Directory, the location connection test fails with the following errors:

• F_JG290D: Received status code 403 (Forbidden). AWS S3 error [Code:AccessDenied. Message: User is not authorized to perform: s3:GetBucketLocation on resource: arn:aws:s3:::<bucket-name> because no resource-based policy allows the s3:GetBucketLocation action.]
• F_JG0557: The previous error occurred during request [POST /latest/hubs/<hub_name>/new_loc/test].

Environment

• HVR 6
• Target: Databricks
• Staging: Amazon S3

Resolution

To resolve this issue:

1. Log in to the HVR 6 web UI.
2. Open the affected replication channel.
3. Go to the Actions configuration of the channel.
4. Add an Environment action with the following parameters:
   • Name=HVR_S3_BOOTSTRAP_REGION
   • Value=<s3_bucket_region>
   Replace <s3_bucket_region> with the actual value, such as us-west-2.

5. Save the configuration.
6. Activate the channel to apply the changes.
7. Start the Refresh job.
8. Verify that data loads successfully into Databricks.

Validate the bootstrap region

To verify the AWS identity and bucket region, run the following commands on the HVR host:

1. Check which AWS identity HVR uses:

   aws sts get-caller-identity
   

2. Get the region of your S3 bucket:

   aws s3api get-bucket-location \
     --bucket <bucket-name>
   

   For a bucket in us-west-2, the output looks like this:

   {
     "LocationConstraint": "us-west-2"
   }
   

3. Confirm that LocationConstraint matches the value of HVR_S3_BOOTSTRAP_REGION.

If the regions match and the error persists, review the IAM role, bucket policy, and effective AWS permissions for the identity returned in step 1.

For more information, see Staging for Databricks.

Cause

This issue occurs when the HVR Databricks target connection test tries to determine the AWS S3 bucket region using the GetBucketLocation operation and the request fails.

HVR normally connects to us-east-1 initially to determine the S3 bucket region. The HVR_S3_BOOTSTRAP_REGION setting instructs HVR to use the S3 bucket's actual region for the bootstrap operation instead of the default us-east-1.