S3 Access Denied (403 Forbidden) Error

How to fix it

Try these in order — the most common fix is first.

1. 1. Read the error message

   Copy steps
   1. It may name the policy type: SCP, VPC endpoint policy, permissions boundary, resource-based or identity-based
   2. 'explicit deny' means remove or adjust a Deny; 'no ... policy allows' means add an Allow
   Did this fix it? Yes No

2. 2. Fix IAM and bucket policy

   Copy steps
   1. Bucket actions (ListBucket) use arn:aws:s3:::bucket; object actions (GetObject, PutObject) use arn:aws:s3:::bucket/*
   2. Check the bucket policy for Deny statements and conditions
   Did this fix it? Yes No

3. 3. Check Block Public Access and ownership

   Copy steps
   1. S3 > bucket > Permissions: Block Public Access and Object Ownership
   2. With Bucket owner enforced, ACLs are disabled
   Did this fix it? Yes No

4. 4. Check KMS

   1. The caller needs kms:Decrypt (and GenerateDataKey for uploads) on the key
   Did this fix it? Yes No

5. 5. Check network and org policies

   Copy steps
   1. VPC endpoint policy, Organizations SCP/RCP
   2. Use IAM policy simulator or CloudTrail to find the denying policy
   Did this fix it? Yes No

Symptoms

GetObject, PutObject or ListBucket returns AccessDenied / 403 Forbidden.

Why it happens

• Identity-based policy lacks the s3 action or resource ARN (bucket vs bucket/*)
• Bucket policy denies or doesn't allow the principal
• Block Public Access is on
• Object owned by another account (ACLs/Object Ownership)
• Objects encrypted with a KMS key you can't use
• VPC endpoint policy or SCP denies the request
• Requester Pays bucket

This guide also covers

• s3 access denied
• aws s3 403 forbidden
• s3 bucket policy access denied
• s3 getobject access denied

The same problem in other apps

All not loading, error messages & connection guides →

• DigitalOcean Droplet SSH Connection Refused or Timed Out (DigitalOcean)
• Vercel FUNCTION_INVOCATION_TIMEOUT (504) Error (Vercel)

Other AWS errors

• AWS Unexpected Charges: Why Is My AWS Bill So High?
• AWS Charges After Free Tier: Why Am I Being Billed?
• AWS Account Suspended: How to Reactivate It
• EC2 SSH Connection Timed Out
• EC2 SSH 'Permission denied (publickey)' and Key File Errors
• AWS 'Not Authorized to Perform' IAM Error
• Lambda 'Task timed out after 3.00 seconds' Error
• CloudFront 403 Error: The Request Could Not Be Satisfied