Data Action fails on S3 upload for legal hold exports

What is the standard approach to handle authentication in a custom Data Action when pushing Genesys Cloud bulk export results to an S3 bucket for legal hold in Europe/London? The action returns 403 Forbidden on the PUT request even though the IAM role has full access. Environment is v2024.1.0. The error occurs during the final write step.