Before using this plugin, you need to configure the necessary AWS service permissions for your IAM user. As a suggestion, create a policy as described below and then attach it to your user’s permission list. This will allow you to use the plugin without access limitations for both Rekognition and S3:
{
   "Version": "2012-10-17",
   "Statement": [
       {
           "Effect": "Allow",
           "Action": [
               "s3:PutObject",
               "s3:GetObject"
           ],
           "Resource": "arn:aws:s3:::your-bucket-name/*"
       },
       {
           "Effect": "Allow",
           "Action": [
               "rekognition:CompareFaces"
           ],
           "Resource": "*"
       }
   ]
}