How to Fix Access Denied (AWS S3)

Quick Answer: Access Denied errors on S3 typically mean your IAM user/role lacks permissions or the S3 bucket policy explicitly denies access. The fastest fix is to check the IAM policy attached to your user/role and ensure it grants `s3:GetObject` or `s3:PutObject` for the target resource. For example, add `"Action": "s3:GetObject", "Resource": "arn:aws:s3:::your-bucket-name/*"` to your IAM policy.

What Causes This Error

IAM User/Role lacks necessary S3 permissions.
S3 bucket policy explicitly denies access.
S3 Block Public Access settings are enabled.
Object ownership settings prevent access (e.g., object uploaded by another account).
KMS encryption key policy denies access (if using SSE-KMS).
VPC Endpoint policy denies access (if accessing S3 via a VPC Endpoint).
Requester Pays is enabled, and the requester is not paying.

Step-by-Step Fixes

Fix 1: Verify IAM User/Role Permissions

Go to IAM console -> Users or Roles.,Select the user or role experiencing the issue.,Under 'Permissions', expand each policy and review the 'Action' and 'Resource' sections. Ensure actions like `s3:GetObject`, `s3:PutObject`, `s3:ListBucket` are allowed for the target bucket and objects.,If permissions are missing, attach a new policy or edit an existing one. Example policy statement for read access: `{ "Effect": "Allow", "Action": "s3:GetObject", "Resource": "arn:aws:s3:::your-bucket-name/*" }`

Fix 2: Review S3 Bucket Policy

Go to S3 console -> Buckets.,Select the affected bucket.,Go to 'Permissions' tab -> 'Bucket policy'.,Examine the policy for any 'Deny' statements that might override 'Allow' statements from IAM. Look for conditions that might be denying access based on IP, user, or other criteria.,Modify or remove conflicting 'Deny' statements. Example: If a policy denies access to a specific IP, ensure your current IP is not in that range.

Fix 3: Check S3 Block Public Access Settings

Go to S3 console -> Buckets.,Select the affected bucket.,Go to 'Permissions' tab -> 'Block public access (bucket settings)'.,Verify that 'Block all public access' is not enabled if you intend for public access. If it is enabled and you require public access, disable it. Note: This is generally not recommended for sensitive data.,Also, check 'Account settings for Block Public Access' in the S3 console. These settings can override bucket-level settings.

Fix 4: Verify Object Ownership

Go to S3 console -> Buckets.,Select the affected bucket.,Go to 'Permissions' tab -> 'Object Ownership'.,If 'ACLs disabled' is selected (recommended), ensure the bucket owner has full control. If 'ACLs enabled' is selected, check the ACLs for the specific object causing the error. Objects uploaded by another account might have ACLs that prevent your account from accessing them.,To grant bucket owner full control over new objects uploaded by other accounts, set 'Bucket owner preferred' in Object Ownership settings.

Fix 5: Examine KMS Key Policy (if using SSE-KMS)

Go to KMS console -> Customer managed keys.,Select the KMS key used for encrypting the S3 objects.,Go to 'Key policy' tab.,Ensure the IAM user/role attempting to access the S3 object has `kms:Decrypt` and `kms:GenerateDataKey` permissions granted in the KMS key policy.,Example policy statement: `{ "Effect": "Allow", "Principal": { "AWS": "arn:aws:iam::123456789012:user/your-user" }, "Action": [ "kms:Decrypt", "kms:GenerateDataKey" ], "Resource": "*" }`

Advanced Fixes

Advanced Fix 1: Advanced Fix: Cross-Account Access Denied Due to Object Ownership

Identify the S3 bucket and object experiencing the issue.,Verify the current Object Ownership setting for the bucket. Navigate to S3 > Buckets > [Your Bucket] > Permissions > Object Ownership.,If 'Object ownership' is set to 'Object writer' or 'Bucket owner preferred' without explicit ACLs on objects, and objects are uploaded by different accounts, change the setting to 'Bucket owner enforced'. This disables ACLs and makes the bucket owner the owner of all objects.,Alternatively, if 'Bucket owner enforced' is not desired, ensure the uploading account grants the bucket owner full control via an object ACL during upload (e.g., using `aws s3 cp s3://source-bucket/object s3://destination-bucket/object --acl bucket-owner-full-control`).

Advanced Fix 2: Advanced Fix: Access Denied Due to S3 Block Public Access Settings

Identify the S3 bucket or AWS account experiencing the issue.,Navigate to S3 > Buckets > [Your Bucket] > Permissions > Block public access (bucket settings). Review all four settings: 'Block public access to buckets and objects granted through new access control lists (ACLs)', 'Block public access to buckets and objects granted through any access control lists (ACLs)', 'Block public access to buckets and objects granted through new public bucket policies', 'Block public and cross-account access to buckets and objects through any public bucket policies'.,If public or cross-account access is intended, and any of these settings are enabled, disable the specific setting that is preventing the desired access. For example, if you need a public bucket policy, ensure 'Block public and cross-account access to buckets and objects through any public bucket policies' is disabled.,Also, check the AWS account-level Block Public Access settings (S3 > Block Public Access settings for this account) as these can override bucket-level settings.

Advanced Fix 3: Advanced Fix: Access Denied with S3 VPC Endpoint Policies

Identify the VPC endpoint being used to access S3.,Navigate to VPC > Endpoints > [Your S3 Endpoint] > Policy.,Review the VPC endpoint policy. Ensure it explicitly allows the necessary S3 actions (e.g., `s3:GetObject`, `s3:PutObject`) for the principal and resources involved.,If the endpoint policy restricts access, modify it to include the required permissions. For example, add a statement allowing `s3:GetObject` for a specific IAM role to a specific bucket.