Screen Recording Export Job Failing with 403 Forbidden on S3 Put

General Discussion
1
  • Genesys Cloud Region: ap-southeast-1 (Singapore)
  • Terraform Version: 1.7.5
  • Provider: mypurecloud/genesyscloud v3.5.2
  • AWS S3 Bucket: Encrypted with KMS, Block Public Access enabled
  • IAM Role: Has s3:PutObject and s3:PutObjectAcl permissions

Why does this setting cause the export job to fail immediately after initiation?

Configured the recording export via Terraform:

resource "genesyscloud_recording_export" "daily_export" {
 name = "Daily Screen Export"
 status = "ACTIVE"
 
 export_destination {
 type = "S3"
 bucket = "my-cx-exports"
 region = "ap-southeast-1"
 folder = "screen/"
 }
}

The job starts but fails within 30 seconds. The error log in the admin portal shows:
Failed to write object to S3. HTTP 403 Forbidden. AccessDenied: Access Denied. RequestId: ABC123...

The IAM policy attached to the role used by Genesys Cloud definitely allows writes. Tested manually with AWS CLI using the same credentials and it works. Suspect the issue is related to the KMS key policy or the specific ACL header Genesys sends by default. Does the provider support specifying a custom ACL or KMS key ID in the export_destination block? The docs are silent on this.