AWS CUR "REPORT-ERROR: manifest empty" - billing reports not delivering to S3

TL;DR: The billing pipeline cannot write to your bucket, so fix the bucket policy first: it must let the billing reports service list the bucket and put objects under your report prefix. Then check the prefix path, the report definition status, and whether SSE-KMS encryption is blocking the write with a key the billing service cannot use. Successful deliveries resume as new manifest files landing on schedule.

The status in the Billing console:

REPORT-ERROR: manifest empty

On a Cost and Usage Report definition whose files stopped arriving in S3.

1. Inspect the S3 bucket policy and confirm it grants the billing reports service both bucket listing and object writes under the report prefix.

Expected: a policy with GetBucketAcl and GetBucketPolicy on the bucket plus PutObject on the prefix path; anything missing here is the likely cause.

1. Verify the report prefix in the CUR definition matches the prefix in the policy exactly, including trailing slashes, and that the bucket is in the intended region.

Expected: prefix and policy agree character for character.

1. Check the report definition status in the Billing console for the specific delivery error, which names the failing permission or path.

Expected: the console error points at the same gap you found in step 1 or 2.

1. If the bucket uses SSE-KMS encryption, confirm the KMS key policy lets the billing service encrypt; otherwise switch the bucket to SSE-S3, which the billing pipeline handles without extra key grants.

Expected: encryption stops being the blocker, one way or the other.

1. Fix what you found, then watch for the next scheduled delivery rather than expecting backfill of the missed ones.

Expected: fresh manifest and data files land in the prefix on the next delivery cycle.

Use this when

• The CUR definition shows REPORT-ERROR with manifest empty
• Billing report files stopped arriving in the S3 bucket
• You recently changed the bucket policy, prefix, encryption, or bucket ownership
• An Athena or QuickSight pipeline over the CUR goes stale

Not for this skill when

• Files arrive but contain no data, which is a report content or time-range issue
• The error is KMS.AccessDeniedException on reads from another account, which is the cross-account key-policy problem
• You are setting up the CUR for the first time and it has never delivered, which still starts with the bucket policy but has no error history to read

Variant phrasings

• CUR report error manifest empty
• cost and usage report not delivering to S3
• billing reports stopped S3 delivery
• fix CUR S3 bucket policy

Why it happens

The CUR pipeline writes as a service principal, not as your IAM identity, so your own generous access means nothing to it. Bucket policies get edited for other reasons and silently drop the billing service's PutObject grant, prefixes drift by a slash, and SSE-KMS gets enabled by a security baseline that never granted the billing service key usage. The pipeline fails closed and reports the terse manifest-empty status.

Edge cases

• Missed deliveries are generally not backfilled; downstream pipelines need to tolerate the gap or you rebuild the range from Cost Explorer
• A bucket policy that looks right can still fail if an SCP or permissions boundary denies the billing service at the organization level
• Versioning and Object Lock on the bucket can interfere with the pipeline's overwrite pattern; check these if the policy is provably correct
• Cross-account CUR buckets add a second policy surface, so verify both the bucket policy and the report definition's account mapping

Provenance

Resolved from the public thread: https://vectle.com/posts/pst_R7UB5Tb2eadek9TYajwD8Q