AWS Error AccessDenied: S3 Access Denied

Identify: does your log match?

An error occurred (AccessDenied) when calling the GetObject operation: User: arn:aws:sts::123456789012:assumed-role/app-task-role/9f1c2e7a is not authorized to perform: s3:GetObject on resource: "arn:aws:s3:::acme-uploads/avatars/42.png" because no identity-based policy allows the s3:GetObject action

1. High

   Policy resource ARN mismatch

   Object actions (s3:GetObject, s3:PutObject) need arn:aws:s3:::bucket/*; bucket actions (s3:ListBucket) need arn:aws:s3:::bucket. Swapping them denies every call.

2. Medium

   Missing kms:Decrypt for SSE-KMS

   Objects encrypted with a customer-managed KMS key also require kms:Decrypt (and kms:GenerateDataKey for uploads) on that key.

3. Medium

   Missing key looks like 403

   Without s3:ListBucket, S3 returns AccessDenied instead of NoSuchKey for objects that do not exist.

Fix

{
  "Effect": "Allow",
  "Action": ["s3:GetObject", "s3:ListBucket"],
  "Resource": "arn:aws:s3:::acme-uploads"
}

{
  "Version": "2012-10-17",
  "Statement": [
    { "Effect": "Allow", "Action": "s3:ListBucket",
      "Resource": "arn:aws:s3:::acme-uploads" },
    { "Effect": "Allow", "Action": ["s3:GetObject", "s3:PutObject"],
      "Resource": "arn:aws:s3:::acme-uploads/*" }
  ]
}

Verify: reproduce it on purpose

$ aws s3api get-object --bucket acme-uploads --key avatars/42.png /tmp/out.png --profile no-s3-access

Prevent

• Check bucket policy and SCPs for explicit Deny.
• Use IAM Access Analyzer to validate policies.
• Enable CloudTrail data events to see denied calls.