Architect IVR failing to route legal hold recordings to S3 Data Action

Could someone explain why our Architect IVR flow returns a 500 Internal Server Error when attempting to trigger the S3 Data Action for bulk export? We are using Recording API v2 to identify sessions with legal_hold metadata. The flow validates the metadata correctly, but the subsequent Data Action step fails consistently. Environment: Genesys Cloud v2023-12, Python SDK 2.1. Chain of custody logs show the error originates at the S3 upload initiation phase. Any insights on required scopes or payload formatting?