# AWS S3: AccessDenied (403) when calling GetObject / PutObject

**Code:** `AccessDenied` · **Category:** AWS · **Seen on:** AWS

An IAM policy, bucket policy, ACL/ownership setting, Block Public Access or KMS key policy denied the S3 request.

## Meaning

S3 evaluates several policy layers; any explicit Deny or missing Allow results in AccessDenied. S3 also returns 403 (instead of 404) for missing objects when the caller lacks `s3:ListBucket`.

## Common causes

- IAM policy lacks the action (`s3:GetObject`, `s3:PutObject`) on the right resource ARN (`bucket/*` for objects)
- Bucket policy explicit Deny (e.g. require TLS, VPC endpoint, specific principal)
- Object owned by another account / ACLs disabled mismatch
- Block Public Access prevents public reads
- Object encrypted with a KMS key the caller can’t use (`kms:Decrypt`)
- Object doesn’t exist and caller lacks ListBucket (403 instead of 404)
- Wrong credentials/role actually in use

## Quick fix

1. Confirm the identity: `aws sts get-caller-identity`
2. Check the IAM policy resource: bucket ARN for ListBucket, `bucket/*` for object actions
3. Review the bucket policy for Deny statements
4. For SSE-KMS objects, grant `kms:Decrypt` / `kms:GenerateDataKey`
5. Use IAM Policy Simulator or CloudTrail to see which policy denied

## Detailed fix by platform

### AWS

1. Minimal read policy:

```json
{
  "Version": "2012-10-17",
  "Statement": [
    { "Effect": "Allow", "Action": "s3:ListBucket", "Resource": "arn:aws:s3:::my-bucket" },
    { "Effect": "Allow", "Action": "s3:GetObject",  "Resource": "arn:aws:s3:::my-bucket/*" }
  ]
}
```


## Code examples

### Debug from the CLI

```bash
aws sts get-caller-identity
aws s3api head-object --bucket my-bucket --key path/file.txt
aws s3api get-bucket-policy --bucket my-bucket
```

## How to diagnose

1. **Identity** — Which principal is making the call?
2. **IAM policy** — Allows the action on the right ARN?
3. **Bucket policy** — Any explicit Deny or conditions?
4. **Object** — Exists? Owned by bucket owner?
5. **KMS** — Key policy allows decrypt?
6. **Public access** — Block Public Access settings?

---
Source: [WhatIsMyError](https://whatismyerror.com/errors/aws/s3-access-denied)