Amazon S3 Access Denied in the Console: What to Check First
Troubleshoot S3 AccessDenied messages by checking identity policies, bucket policies, encryption, organization controls, and account context.
An S3 AccessDenied error can arise from bucket access, object access, encryption permissions, organization guardrails, or the identity used in the request. Avoid changing a bucket policy until you know which operation failed and which principal made it.
Identify the denied S3 operation
Opening a bucket, listing objects, downloading an object, and reading an encrypted object require different permissions. Record the operation and resource ARN from the message. A successful bucket listing does not guarantee object download access.
Verify the caller and account
Confirm the current account, role, and Region. For cross-account access, review both the requesting identity’s permissions and the resource-side policy. If SSE-KMS is involved, the key policy and KMS permissions may also matter.
Review bucket and organization restrictions
Inspect explicit denies, conditions, VPC endpoint policies, organization policies, and permissions boundaries. Conditions based on source IP, VPC, tags, encryption, or TLS can make an otherwise valid request fail.
Check object ownership and encryption context
Legacy object ownership settings, access points, and KMS-encrypted objects can add policy layers. Use the exact failing object and request context; do not make a bucket public as a diagnostic shortcut.
Test the narrowest safe fix
Ask the resource owner to grant only the required action on the required resources, with existing security conditions preserved. Retest using the same principal and path that originally failed.
Frequently asked questions
Should I make the S3 bucket public?
No. Public access is not an appropriate general fix for AccessDenied. Identify the caller and policy layer, then use scoped permissions.
Why can I list a bucket but not download a file?
Listing and reading objects are different actions, and object-level policy or encryption permissions may differ.
Official documentation and further reading
Make AWS error investigations easier
SameWindow AWS Assistant is designed to help organize supported visible AWS Console errors into a clearer investigation workflow. It does not replace AWS documentation, service logs, security review, or administrator approval. Review the product details and setup status before installing.
Explore SameWindow AWS AssistantSetup instructions