Tableau Cloud Activity Log – "Failed to replicate security verification file" when connecting to an AWS S3 bucket

Work through the following steps in order, stopping when the connection succeeds. Each fix is made in your own AWS account. Refer throughout to the Tableau Activity Log setup guide and its Role mapping by region section.

Step 1 — Confirm your S3 bucket is in the correct AWS region for your Tableau Cloud pod

Your target bucket must be in the AWS region that matches your Tableau Cloud pod. A region mismatch appears specifically as Code: 2.

1. Identify your pod's region (for example, a us-east-1 pod requires a bucket in us-east-1).
2. Confirm your S3 bucket was created in that same region.
3. If it was not, create the bucket in the correct region and retry enabling the connection.

Step 2 — Add the required S3 replication actions to your bucket policy

This is the most commonly missed requirement. A bucket policy that grants only Put and Get permissions can look complete but will still fail with this error.

1. Open your S3 bucket policy.
2. Confirm the Tableau replication role is granted both of the following actions:
   • s3:ReplicateObject
   • s3:ReplicateDelete
3. Add either action if it is missing, save the policy, and retry enabling the connection.

Step 3 — If you use SSE-KMS encryption, grant Tableau permissions on your KMS key policy

If your bucket is encrypted with SSE-KMS using a customer-managed key, your KMS key policy must also allow the Tableau role to use the key. Without this, Tableau cannot encrypt the object it writes to your bucket, and the verification file will fail to replicate even when your bucket policy is correct.

1. Open the KMS key policy for the key that protects your bucket.
2. Grant the Tableau replication role the key-usage permissions required by the setup guide — the permissions needed to generate a data key for and encrypt the replicated object, namely kms:GenerateDataKey and kms:Encrypt.
3. Save the policy and retry enabling the connection.

Step 4 — Confirm the correct region-specific IAM role is referenced in both policies

Both your bucket policy and your KMS key policy must reference the current Tableau replication role for your region. Referencing an outdated role — or leaving a placeholder value in place — will prevent the policy from saving correctly or cause replication to keep failing.

1. Look up your region's role in the Setup Guide's role mapping by region table.
2. Confirm this exact role is referenced in both the bucket policy and the KMS key policy, save, and retry.

Step 5 — If the status stays on "In progress" rather than failing, retry from Integrations Settings

If the connection does not fail outright but instead remains on "In progress" for an extended period (and the SECURITY_VERIFICATION_FILE.txt never appears in your bucket), this is intermittent behaviour rather than a policy error.

1. From your site's Integrations Settings page, retry enabling Activity Log.
2. Repeat the attempt if needed — a repeated retry will often complete the configuration.
3. If the status remains stuck after several retries and you have confirmed all of the policy settings above are correct, contact Tableau Support for further assistance.