title: How to allow GetBucketLocation promission on s3 bucket in order to create CA
body: <p>In order to update the SSL certificate on AWS, CA is required for the CSR.</p>
  
  <p>When I try to configure and create the CA, I get this massage: </p>
  
  <blockquote>
    <p>ValidationException The ACM Private CA Service Principal
    'acm-pca.amazonaws.com' requires 's3:GetBucketLocation' permissions
    for your S3 bucket 'MyBucket'. Check your S3 bucket permissions and
    try again</p>
  </blockquote>
  
  <p>To move forward with this, permission settings on Amazon S3 > <em>MyBucket</em> > Permissions > Bucket Policy:</p>
  
  <pre><code>{
      "Version": "2012-10-17",
      "Statement": [
          {
              "Sid": "PublicReadGetObject",
              "Effect": "Allow",
              "Principal": "*",
              "Action": "s3:GetObject",
              "Resource": "arn:aws:s3:::MyBucket/*"
          }
      ]
  }
  </code></pre>
  
  <p>According to the documentation, found here: 
  <a href="https://docs.aws.amazon.com/AmazonS3/latest/API/RESTBucketGETlocation.html" rel="nofollow noreferrer">https://docs.aws.amazon.com/AmazonS3/latest/API/RESTBucketGETlocation.html</a></p>
  
  <p><code>LocationConstraint</code> is required.</p>
  
  <p>How to solve the "s3:GetBucketLocation" issue and create the CA?</p>