AWS Glue Job getting Access Denied when writing to S3

Unfortunately the error doesn't tell us much except that it's failing during the write of your DynamicFrame.

There is only a handful of possible reasons for the 403, you can check if you have met them all:

1. Bucket Policy rules on the destination bucket.
2. The IAM Role needs permissions (although you mention having S3*)
3. If this is cross-account, then there is more to check with regards things like to allow-policies on the bucket and user. (In general a Trust for the Canonical Account ID is simplest)
4. I don't know how complicated your policy documents might be for the Role and Bucket, but remember that an explicit Deny statement takes precedence over an allow.
5. If the issue is KMS related, I would check to ensure your Subnet you select for the Glue Connection has a route to reach the KMS endpoints (You can add an Endpoint for KMS in VPC)
6. Make sure issue is not with the Temporary Directory that is also configured for your job or perhaps write-operations that are not your final.
7. Check that your account is the "object owner" of the location you are writing to (normally an issue when read/writing data between accounts)

If none of the above works, you can shed some more light with regards to your setup. Perhaps the code for write-operation.

In addition to Lydon's answer, error 403 is also received if your Data Source location is the same as the Data Target; defined when creating a Job in Glue. Change either of these if they are identical and the issue will be resolved.

You should add a Security configurations(mentioned under Secuity tab on Glue Console). providing S3 Encryption mode either SSE-KMS or SSE-S3.

Security Configuration

Now select the above security configuration while creating your job under Advance Properties.

Duly verify you IAM role & S3 bucket policy. It will work

How are you providing permission for PassRole to glue role?

{
        "Sid": "AllowAccessToRoleOnly",
        "Effect": "Allow",
        "Action": [
          "iam:PassRole",
          "iam:GetRole",
          "iam:GetRolePolicy",
          "iam:ListRolePolicies",
          "iam:ListAttachedRolePolicies"
        ],
        "Resource": "arn:aws:iam::*:role/<role>"
      }

Usually we create roles using <project>-<role>-<env> e.g. xyz-glue-dev where project name is xyz and env is dev. In that case we use "Resource": "arn:aws:iam::*:role/xyz-*-dev"

For me it was two things.

1. Access policy for a bucket should be given correctly - bucket/*, here I was missing the * part
2. Endpoint in VPC must be created for glue to access S3 https://docs.aws.amazon.com/glue/latest/dg/vpc-endpoints-s3.html

After these two settings, my glue job ran successfully. Hope this helps.

Make sure you have given the right policies. I was facing the same issue, thought I had the role configured well. But after I erased the role and followed this step, it worked ;]