# Ion deploy fails due to Access Denied **URL:** \ **Category:** Troubleshooting\ **Created:** [October 31, 2018, 7:59pm UTC](https://forum.datomic.com/t/ion-deploy-fails-due-to-access-denied/685 "2018-10-31T19:59:49Z")\ **Posts on this page:** 10\ **Page:** 1
**Author:** ![andre](https://sea2.discourse-cdn.com/flex016/user_avatar/forum.datomic.com/andre/32/177_2.png) [@andre](https://forum.datomic.com/u/andre)\ **Post date:** [October 31, 2018, 7:59pm UTC](https://forum.datomic.com/t/ion-deploy-fails-due-to-access-denied/685/1 "2018-10-31T19:59:49Z")
Following the ion tutorial. On first deploy, when doing {:op :deploy-status} I get: `{:deploy-status "FAILED", :code-deploy-status "FAILED"}` Looking in AWS CodeDeploy, it states ‘Most recent event’ is `DownloadBundle`, and when I click on View Events: ![50](https://us1.discourse-cdn.com/flex016/uploads/cognitect/original/1X/563a0bb00ed94ce5739bc29deaa8a3fd29bae6c6.png) What role might be missing for the ‘Access Denied’ error at this stage? ---
**Author:** ![jaret](https://sea2.discourse-cdn.com/flex016/user_avatar/forum.datomic.com/jaret/32/45_2.png) [@jaret](https://forum.datomic.com/u/jaret)\ **Post date:** [November 1, 2018, 6:47pm UTC](https://forum.datomic.com/t/ion-deploy-fails-due-to-access-denied/685/2 "2018-11-01T18:47:32Z")
Hi @Andre, you’ll want to confirm you have sourced the same AWS credentials required to connect to your Datomic Cloud system. Please check that you can connect via proxy/repl as described in tutorial: [https://docs.datomic.com/cloud/getting-started/configuring-access.html](https://docs.datomic.com/cloud/getting-started/configuring-access.html) [https://docs.datomic.com/cloud/getting-started/connecting.html](https://docs.datomic.com/cloud/getting-started/connecting.html) I am going to pull all the required permissions. But I wanted to ask, can you run as administrator? ---
**Author:** ![andre](https://sea2.discourse-cdn.com/flex016/user_avatar/forum.datomic.com/andre/32/177_2.png) [@andre](https://forum.datomic.com/u/andre)\ **Post date:** [November 1, 2018, 11:11pm UTC](https://forum.datomic.com/t/ion-deploy-fails-due-to-access-denied/685/3 "2018-11-01T23:11:13Z")
Yes I can connect with repl via socks proxy fine, create db, do transactions and queries. I’ll try as Administrator tomorrow (late here in UK 😀). ---
**Author:** ![andre](https://sea2.discourse-cdn.com/flex016/user_avatar/forum.datomic.com/andre/32/177_2.png) [@andre](https://forum.datomic.com/u/andre)\ **Post date:** [November 1, 2018, 11:56pm UTC](https://forum.datomic.com/t/ion-deploy-fails-due-to-access-denied/685/4 "2018-11-01T23:56:31Z")
Same issue when using Administrator. A couple of things that might be of interest: - I originally a different system, (never got as far as code deploy, just wanted to see what is involved in get Datomic Cloud system running). I deleted that one, and started over - trying to deploy to new system - I have not gone through the ‘first upgrade’ process - is this essential and maybe the cause for this? I am only running Solo typology. ---
**Author:** ![andre](https://sea2.discourse-cdn.com/flex016/user_avatar/forum.datomic.com/andre/32/177_2.png) [@andre](https://forum.datomic.com/u/andre)\ **Post date:** [November 5, 2018, 3:49pm UTC](https://forum.datomic.com/t/ion-deploy-fails-due-to-access-denied/685/5 "2018-11-05T15:49:09Z")
I started fresh, with a brand new AWS account, and everything works fine when I follow the tutorial. I successfully deployed using both the ‘root’ AWS account, and an IAM account with `AdministratorAccess` and `datomic-admin-xxxx-eu-west-1` roles attached. So unfortunately I still don’t know what was wrong with previous setup, but I’m very happy that I can now proceed. ---
**Author:** ![marshall](https://sea2.discourse-cdn.com/flex016/user_avatar/forum.datomic.com/marshall/32/48_2.png) [@marshall](https://forum.datomic.com/u/marshall)\ **Post date:** [November 8, 2018, 3:50pm UTC](https://forum.datomic.com/t/ion-deploy-fails-due-to-access-denied/685/6 "2018-11-08T15:50:12Z")
Hi Andre, I’m glad you got the issue resolved. The problem you encountered suggests that somehow the Datomic instance in your system was missing a permission required to read the Ion package from S3. Is it possible that you were running an older version of Datomic Cloud (from before the release of Ions)? -Marshall ---
**Author:** ![marshall](https://sea2.discourse-cdn.com/flex016/user_avatar/forum.datomic.com/marshall/32/48_2.png) [@marshall](https://forum.datomic.com/u/marshall)\ **Post date:** [May 16, 2019, 3:12pm UTC](https://forum.datomic.com/t/ion-deploy-fails-due-to-access-denied/685/7 "2019-05-16T15:12:00Z")
Andre, I realize this is an older topic, but I wanted to update it in case anyone finds it when searching. The steps to check/repair the issue are as follows: - Go to EC2 instances - Select a compute instance - Click IAM role - Open Policy name - Open Datomic Code Policy - Take note of the “Resource” key’s "arn:aws:s3:::datomic-code value - Go to S3 in another tab - Does the datomic-code bucket there match the value in the Code Policy? - If not, go back to IAM policies page - Edit Policy - Go to the Json tab - Replace _BOTH_ datomic-code values in the json with the actual bucket arn you saw in S3 - Review - Save changes This circumstance appears to occur when a user inadvertently deletes the datomic-code bucket from S3. We are also investigating a situation where the bucket appears to have been removed by AWS without having been deleted by the user. -Marshall ---
**Author:** ![ujjwalt](https://sea2.discourse-cdn.com/flex016/user_avatar/forum.datomic.com/ujjwalt/32/209_2.png) [@ujjwalt](https://forum.datomic.com/u/ujjwalt)\ **Post date:** [June 12, 2020, 7:49pm UTC](https://forum.datomic.com/t/ion-deploy-fails-due-to-access-denied/685/8 "2020-06-12T19:49:20Z")
This really helped. Any update on AWS removing the bucket. I still can’t figure out why this happened since I created a new system from scratch. ---
**Author:** ![marshall](https://sea2.discourse-cdn.com/flex016/user_avatar/forum.datomic.com/marshall/32/48_2.png) [@marshall](https://forum.datomic.com/u/marshall)\ **Post date:** [July 14, 2020, 1:15pm UTC](https://forum.datomic.com/t/ion-deploy-fails-due-to-access-denied/685/9 "2020-07-14T13:15:26Z")
The most common cause of this is manually renaming/deleting/altering resources managed by Datomic. The `datomic-code` bucket is shared between all Datomic systems in your AWS account (per region), so the issue is not tied to creation/deletion of an individual system, but rather the “global” bucket used by all systems. ---
**Author:** ![kenny](https://sea2.discourse-cdn.com/flex016/user_avatar/forum.datomic.com/kenny/32/529_2.png) [@kenny](https://forum.datomic.com/u/kenny)\ **Post date:** [August 31, 2020, 11:12pm UTC](https://forum.datomic.com/t/ion-deploy-fails-due-to-access-denied/685/10 "2020-08-31T23:12:55Z")
Just wanted to say thank you for writing this here! I hit this exact issue and had it fixed in a couple of minutes thanks to your comment. I have no idea what caused this particular issue for us. As far as I know, no one tampered with the Datomic bucket (no DeleteBucket events in CloudTrail).