# Terraform: Error: Failed to load state: AccessDenied: Access Denied / Error refreshing state: AccessDenied status code: 403

**Code:** `Error loading state: AccessDenied (S3 backend)` · **Category:** Terraform · **Seen on:** Terraform, AWS

Terraform can't read/write the S3 bucket (or DynamoDB table) that stores state — IAM permissions or wrong credentials/role.

## Meaning

The identity needs `s3:ListBucket` on the bucket and `s3:GetObject/PutObject/DeleteObject` on the key, plus `dynamodb:GetItem/PutItem/DeleteItem` for locking, and `kms:*` if encrypted. Verify the AWS profile/role in use (`aws sts get-caller-identity`), bucket policy/SCPs, region and the `role_arn`.

## Common causes

- Missing s3:GetObject/PutObject/ListBucket
- DynamoDB lock table permissions missing
- Wrong AWS profile/assumed role
- Bucket policy/SCP/VPC endpoint denying
- KMS key policy denying decrypt

## Quick fix

1. `aws sts get-caller-identity` to confirm the identity
2. Grant S3 + DynamoDB (+KMS) permissions on state resources
3. Set `profile`/`role_arn` in the backend block

## Detailed fix by platform

### AWS

1. `aws s3 ls s3://my-tf-state/path/ && aws sts get-caller-identity`

## How to diagnose

1. **Identity** — Which role?
2. **Policy** — S3/DynamoDB/KMS?
3. **Region** — Correct?

---
Source: [WhatIsMyError](https://whatismyerror.com/errors/terraform/s3-backend-access-denied-error-loading-state)