Why can't I access a specific folder or file in my Amazon S3 bucket?

7 minute read

I can't access a certain prefix or object that's in my Amazon Simple Storage Service (Amazon S3) bucket. I can access the rest of the data in the bucket.

Short description

Check the following permissions for any settings that are denying your access to the prefix or object:

If bucket access control lists (ACLs) are attached, then verify the object ownership of the object
Ownership of the prefix or object
Restrictions in the bucket policy
Restrictions in your AWS Identity and Access Management (IAM) user policy
Permissions to objects that are encrypted by AWS Key Management Service (AWS KMS)

Also, note the following conditions for access:

If you encrypted the object with an AWS KMS key, then only the AWS account that encrypted the object can read it.
If you defined permissions boundaries and sessions policies, then the maximum permissions of the requester might be affected. The object access might also be affected.
Other policies, such as Amazon Virtual Private Cloud (Amazon VPC) endpoint policies and service control policies (SCPs), might specify restrictions. Therefore, check these policies and update them accordingly.
You can also control ownership of uploaded objects using Amazon S3 Object Ownership. If you set Object Ownership to BucketOwnerPreferred, then AWS Accounts with the bucket-owner-full-control canned ACL can write objects that transition to the bucket owner.

Resolution

Note: If you receive errors when you run AWS Command Line Interface (AWS CLI) commands, then see Troubleshooting errors for the AWS CLI. Also, make sure that you're using the most recent AWS CLI version.

Ownership of the prefix or object

By default, when an AWS account uploads an S3 object to a bucket, object ownership depends on the bucket's Object Ownership setting. By the default the "Bucket owner enforced" setting is applied to all new buckets. ACLs are turned on and the bucket owner automatically owns all objects regardless of which account uploads them. If ACLs are turned on with the "Bucket owner preferred" setting, the bucket owner owns objects only if they're uploaded with the bucket-owner-full-control canned ACL. Otherwise, the uploading account owns the object. If you turn on ACLs with the "Object writer" setting, the uploading account owns the object even when another account owns the bucket. If other accounts can upload to your bucket and you need to access those objects, check if Bucket ACLs are turned on. If they're turned on, then verify the object ownership of the object.

If other accounts can upload to your bucket, then follow these steps to get permissions to the object or prefix that you can't access:

To get the Amazon S3 canonical ID for your account, run this AWS Command Line Interface (AWS CLI) command:

aws s3api list-buckets --query Owner.ID

Get the Amazon S3 canonical ID of the account that owns the object:

aws s3api list-objects --bucket DOC-EXAMPLE-BUCKET --prefix index.html

If the canonical IDs don't match, then you as the bucket owner don't own the object. For an individual object, the object owner can grant you full control with this put-object-acl command:
```
aws s3api put-object-acl --bucket DOC-EXAMPLE-BUCKET --key object-name --acl bucket-owner-full-control
```
For objects within a prefix, the object owner must re-copy the prefix and grant you full control of the objects as part of the operation. For example, the object owner can run this cp command with the --acl bucket-owner-full-control parameter:
```
aws s3 cp s3://DOC-EXAMPLE-BUCKET/abc/ s3://DOC-EXAMPLE-BUCKET/abc/ --acl bucket-owner-full-control --recursive --storage-class STANDARD
```
This command copies objects to themselves when it applies the bucket-owner-full-control ACL. This transfers ownership to the bucket owner. This approach works only for buckets with the Bucket owner preferred Object Ownership setting.

Note: You can use a bucket policy to require that other accounts grant you ownership of objects that they upload to your bucket.

Restrictions in the bucket policy

Open the Amazon S3 console.
From the list of buckets, open the bucket with the policy that you want to review.
Choose the Permissions tab.
Choose Bucket policy.

Search for statements with "Effect": "Deny". Then, review those statements for references to the prefix or object that you can't access. For example, this bucket policy denies everyone access to the abc/* prefix in DOC-EXAMPLE-BUCKET:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "StatementPrefixDeny",
      "Effect": "Deny",
      "Principal": {
        "AWS": "*"
      },
      "Action": "s3:*",
      "Resource": "arn:aws:s3:::DOC-EXAMPLE-BUCKET/abc/*"
    }
  ]
}

Modify the bucket policy to edit or remove any "Effect": "Deny" statements that incorrectly deny you access to the prefix or object.

Restrictions in your IAM user policy

Open the IAM console.
From the console, open the IAM user or role that you use to access the prefix or object.
In the Permissions tab of your IAM user or role, expand each policy to view its JSON policy document.

In the JSON policy documents, search for policies that relate to Amazon S3 access. Then, search those policies for any "Effect": "Deny" statements that block your access to the prefix or object.

For example, the following IAM policy has an "Effect": "Deny" statement that blocks the IAM identity's access to the prefix abc/* within DOC-EXAMPLE-BUCKET. The policy also has an "Effect": "Allow" statement that grants access to DOC-EXAMPLE-BUCKET. Despite the allow statement for the entire bucket, the explicit deny statement prevents the IAM identity from accessing the prefix abc/*:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "StatementPrefixDeny",
      "Effect": "Deny",
      "Action": "s3:GetObject",
      "Resource": [
        "arn:aws:s3:::DOC-EXAMPLE-BUCKET/abc/*"
      ]
    },
    {
      "Sid": "StatementFullPermissionS3",
      "Effect": "Allow",
      "Action": "s3:GetObject",
      "Resource": [
        "arn:aws:s3:::DOC-EXAMPLE-BUCKET",
        "arn:aws:s3:::DOC-EXAMPLE-BUCKET/*"
      ]
    }
  ]
}

Modify the policy to edit or remove any "Effect": "Deny" statements that incorrectly deny you access to the prefix or object.

Permissions to object encrypted by AWS KMS

If an object is encrypted with a custom AWS KMS key, then you might need permissions to the key. For cross-account scenarios, you need permissions to both the IAM policy and the KMS key policy. For same-account scenarios, you need permissions to either the IAM policy or the KMS key policy.

Check if you can't access the object because you need permissions to an AWS KMS key:

Use the Amazon S3 console to view the properties of one of the objects that you can't access. Review the object's Encryption properties.
If the object is encrypted with a custom AWS KMS key, then review the key policy. Confirm that the policy allows your IAM identity to perform the following actions:
```
"Action": ["kms:Decrypt"]
```
If your IAM identity is missing permissions to any of these actions, then modify the key policy to grant the missing permissions.

Important: If your IAM identity and AWS KMS key belong to different accounts, then verify that you have proper permissions. Both your IAM and key policies must grant you permissions to the required AWS KMS actions.

Note: It's a best practice to turn off bucket ACLs.