title: AWS Glue Job getting Access Denied when writing to S3
body: <p>I have a Glue ETL job, created by CloudFormation. This job extracts data from RDS Aurora and write to S3.</p>
  
  <p>When I run this job, I get the error below.</p>
  
  <p>The job has an IAM service role.</p>
  
  <p>This service role allows </p>
  
  <ol>
  <li>Glue and RDS service, </li>
  <li>assume arn:aws:iam::aws:policy/AmazonS3FullAccess and arn:aws:iam::aws:policy/service-role/AWSGlueServiceRole, and </li>
  <li>has full range of rds:* , kms:* , and s3:* actions allow to the corresponding RDS, KMS, and S3 resources.</li>
  </ol>
  
  <p>I have the same error whether the S3 bucket is encrypted with either AES256 or aws:kms.</p>
  
  <p>I get the same error whether the job has a Security Configuration or not.</p>
  
  <p>I have a job doing the exactly same thing that I created manually and can run successfully without a Security Configuration.</p>
  
  <p>What am I missing? Here's the full error log</p>
  
  <blockquote>
    <p>"/mnt/yarn/usercache/root/appcache/application_1...5_0002/container_15...45_0002_01_000001/py4j-0.10.4-src.zip/py4j/protocol.py", line 319, in get_return_value
    py4j.protocol.Py4JJavaError: An error occurred while calling o145.pyWriteDynamicFrame.
    : org.apache.spark.SparkException: Job aborted due to stage failure: Task 3 in stage 2.0 failed 4 times, most recent failure: Lost task 3.3 in stage 2.0 (TID 30, ip-10-....us-west-2.compute.internal, executor 1): com.amazon.ws.emr.hadoop.fs.shaded.com.amazonaws.services.s3.model.AmazonS3Exception: Access Denied (Service: Amazon S3; Status Code: 403; Error Code: AccessDenied; Request ID: F...49), S3 Extended Request ID: eo...wXZw=
    at com.amazon.ws.emr.hadoop.fs.shaded.com.amazonaws.http.AmazonHttpClient$RequestExecutor.handleErrorResponse(AmazonHttpClient.java:1588</p>
  </blockquote>