S3 Batch Operation fail with error "Anonymous users cannot copy objects. Please authenticate"

Question

I have an IAM role with full access to my s3 given the permission

```
"s3:*"
```

I am trying to use the s3 batch operation to copy some files from my buckets back to them while adding encryption to the files. So first I have added the batch operations trust relationship below into my IAM role in order to run my batch operation jobs and triggered some jobs for different buckets.
```
{
            "Effect": "Allow",
            "Principal": {
                "Service": "batchoperations.s3.amazonaws.com"
            },
            "Action": "sts:AssumeRole"
        }
```

For my surprise, although I had no issues with most of my buckets, for a few buckets the batch operation failed. when I checked the report containing the error, I got this for the objects that could not be copied

```
Anonymous users cannot copy objects.  Please authenticate. (Service: Amazon S3; Status Code: 403; Error Code: AccessDenied
```

Here are some additional details about my setup:
- All buckets have ACLs disabled.
- All public access is blocked.
- The IAM role is used to trigger the batch operation jobs and it works for some buckets but not for others.

Oleksii Bebych · Answer

If you are adding encryption to the files, ensure that the IAM role has the necessary permissions to use the encryption key. If you are using a Customer Managed Key (CMK) in KMS, you need to grant the role permissions to use the key:

```
{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Principal": {
                "AWS": "arn:aws:iam::YOUR_ACCOUNT_ID:role/YOUR_IAM_ROLE"
            },
            "Action": [
                "kms:Encrypt",
                "kms:Decrypt",
                "kms:ReEncrypt*",
                "kms:GenerateDataKey*",
                "kms:DescribeKey"
            ],
            "Resource": "arn:aws:kms:REGION:YOUR_ACCOUNT_ID:key/YOUR_KMS_KEY_ID"
        }
    ]
}
```

S3 Batch Operation fail with error "Anonymous users cannot copy objects. Please authenticate"

Add your answer

Relevant content