reg-suit S3 publish authentication failed in CI

By Daniel Zoghalchali·Latchkey

The reg-publish-s3-plugin uploads expected and actual images to an S3 bucket. If the runner has no AWS credentials, or they lack access to the bucket, the upload fails with AccessDenied and the report cannot be stored.

What this error means

reg-suit fails during publish with "AccessDenied," "The AWS Access Key Id you provided does not exist," or "CredentialsError: Missing credentials." The comparison may complete but the report never publishes.

[reg-suit] error Failed to publish the results.
AccessDenied: Access Denied
    at ... reg-publish-s3-plugin

Common causes

AWS credentials not provided to the job

The runner has no AWS_ACCESS_KEY_ID/AWS_SECRET_ACCESS_KEY or OIDC role, so the S3 client cannot authenticate.

The principal lacks bucket permissions

Credentials exist but the IAM policy does not allow s3:PutObject/s3:GetObject on the snapshot bucket, producing AccessDenied.

How to fix it

Provide credentials via secrets or OIDC

Configure AWS credentials for the job, ideally via an OIDC role, and confirm the bucket policy grants read and write.

- uses: aws-actions/configure-aws-credentials@v4
  with:
    role-to-assume: arn:aws:iam::123456789012:role/reg-suit-s3
    aws-region: us-east-1

Grant least-privilege bucket access

Attach a policy allowing get/put on the snapshot bucket to the CI principal.

{
  "Effect": "Allow",
  "Action": ["s3:GetObject", "s3:PutObject", "s3:ListBucket"],
  "Resource": ["arn:aws:s3:::my-visual-snapshots", "arn:aws:s3:::my-visual-snapshots/*"]
}

How to prevent it

• Use an OIDC role so no long-lived keys sit in CI.
• Grant the CI principal least-privilege get/put on the bucket.
• Keep the bucket name and region consistent with regconfig.json.

Frequently asked questions

Related guides

References

• GitHub Actions documentation