AccessDenied in old files of bucket

Hello,

My first guess was that your role might only have access to certain files in the bucket and not the older ones. But now, I think it looks more likely that the old files could be encrypted differently. Could you try using the AWS CLI to check the encryption type for these files? Here's the command:

aws s3api head-object --bucket <bucket-name> --key <file-key>

Look for the ServerSideEncryption field in the response:

• If it shows aws:kms, the object is encrypted with a KMS key.
• If it shows AES256, the object is encrypted with S3-managed encryption.
• If no encryption is specified, the object is not encrypted.

If the old files are encrypted using KMS, you need to:

• Identify the KMS key used to encrypt these objects.
• Ensure your IAM Role/User has Decrypt permission for this KMS key.
• Then you could re-encrypt older files if necessary

Note: I noticed your Principal field in the bucket policy is empty. Could that be causing some issues? Here’s an example of what it should look like:

"Principal": {
    "AWS": "*"
}

Hope it helps 😊

Hello,

Thank you very much for your answer!

Unfortunately I didn't manage to do it from aws cli.

I navigated to this file from AWS Management Console and I saw that it says that it is encrypted with this way (see screenshot): (Old file access denied https://snipboard.io/jFoQcm.jpg, new file access ok https://snipboard.io/P7gyrT.jpg).

Also, I added this "Principal": { "AWS": "*" } and in old files returns me error: <Error> <Code>InvalidRequest</Code> <Message>The object was stored using a form of Server Side Encryption. The correct parameters must be provided to retrieve the object.</Message> ....

Some days ago all files was ok! What changed now?

Thank you very much again!

I have a whole bucket with hundreds of thousands of files with this exact same issue. We changed nothing, they were all available 2 days ago, and now only things we uploaded in the last several hours are accessible. I also tried running the copy with new encryption from above and got the same error as the root level user on the account. I cant download in the S3 UI or through the, we have just completely lost access to a lot of very important files.

After trying everything above and looking around, I noticed every file had a last updated within a 4 hour period, and then found a warning.txt file that was left by the person who did this basically saying they encrypted all of the files and if I want them back, I ahve to pay them 0.3 bitcoin to an address. My errors and screenshot look just like yours so most likely you are dealing with ransomware too.