S3 403 and Access Problems

Sign in and set names:

cd C:\aws-lab
aws login --profile saat-admin
$env:AWS_PROFILE = 'saat-admin'
$acct = aws sts get-caller-identity --query Account --output text
$b = "saat-s3lab-$acct-ap-south-1-an"

1Set up the bucket, files and a reader role

Paste this whole block. It creates a bucket, a KMS key, two files (one encrypted with that key) and a role that can only GetObject:

aws s3api create-bucket --bucket $b --bucket-namespace account-regional --region ap-south-1 --create-bucket-configuration LocationConstraint=ap-south-1 | Out-Null
$key = aws kms create-key --description "saat S3 403 lab" --tags TagKey=course,TagValue=saatvedha-aws --query KeyMetadata.Arn --output text
aws kms create-alias --alias-name alias/saat-s3-lab --target-key-id $key
'month,total' | Set-Content jan.csv
'name,salary' | Set-Content payroll.csv
aws s3 cp jan.csv "s3://$b/reports/jan.csv" --only-show-errors
aws s3 cp payroll.csv "s3://$b/secret/payroll.csv" --sse aws:kms --sse-kms-key-id $key --only-show-errors
@{ Version = '2012-10-17'; Statement = @(@{ Effect = 'Allow'; Principal = @{ AWS = "arn:aws:iam::$($acct):root" }; Action = 'sts:AssumeRole' }) } | ConvertTo-Json -Depth 5 | Set-Content reader-trust.json
@{ Version = '2012-10-17'; Statement = @(@{ Effect = 'Allow'; Action = 's3:GetObject'; Resource = "arn:aws:s3:::$b/*" }) } | ConvertTo-Json -Depth 5 | Set-Content reader-policy.json
$roleArn = aws iam create-role --role-name saat-lab-reader --assume-role-policy-document file://reader-trust.json --query Role.Arn --output text
aws iam put-role-policy --role-name saat-lab-reader --policy-name read-objects --policy-document file://reader-policy.json
aws configure set profile.saat-reader.role_arn $roleArn
aws configure set profile.saat-reader.source_profile saat-admin
aws configure set profile.saat-reader.region ap-south-1
Start-Sleep 15
aws s3api get-object-attributes --bucket $b --key secret/payroll.csv --object-attributes ObjectSize --query ObjectSize --output text
aws s3api head-object --bucket $b --key secret/payroll.csv --query "[ServerSideEncryption,SSEKMSKeyId]" --output text
aws s3 cp "s3://$b/reports/jan.csv" - --profile saat-reader

You should see something like this:

13
aws:kms arn:aws:kms:ap-south-1:111122223333:key/1a2b3c4d-5e6f-7a8b-9c0d-e1f2a3b4c5d6
month,total

The reader can read reports/jan.csv. As admin you confirmed payroll.csv exists and is encrypted with your KMS key; checking the object as an admin first is always step one.

2Meet the 403 that is really a 404

Ask for a report that doesn’t exist:

aws s3api head-object --bucket $b --key reports/feb.csv --profile saat-reader

You’ll get this:

An error occurred (403) when calling the HeadObject operation: Forbidden

The file simply isn’t there, but without s3:ListBucket S3 won’t say so. Users report this as “access denied on feb.csv”, and people waste time on permissions. Give the reader ListBucket on the bucket and ask again:

@{ Version = '2012-10-17'; Statement = @(
  @{ Effect = 'Allow'; Action = 's3:GetObject'; Resource = "arn:aws:s3:::$b/*" },
  @{ Effect = 'Allow'; Action = 's3:ListBucket'; Resource = "arn:aws:s3:::$b" }) } | ConvertTo-Json -Depth 5 | Set-Content reader-policy.json
aws iam put-role-policy --role-name saat-lab-reader --policy-name read-objects --policy-document file://reader-policy.json
Start-Sleep 15
aws s3api head-object --bucket $b --key reports/feb.csv --profile saat-reader
aws s3 ls "s3://$b/reports/" --profile saat-reader

You should see something like this:

An error occurred (404) when calling the HeadObject operation: Not Found
2026-10-20 16:02:11         13 jan.csv

Now the answer is honest: 404, and the listing shows only jan.csv. Whether to grant ListBucket is a design choice; if you don’t, train your team that 403 might mean “not there”.

3Add an HTTPS-only bucket policy

Real buckets often require HTTPS. Add that rule and confirm the reader still works over HTTPS (the CLI always uses it):

@{ Version = '2012-10-17'; Statement = @(@{ Sid = 'HttpsOnly'; Effect = 'Deny'; Principal = '*'; Action = 's3:*'; Resource = @("arn:aws:s3:::$b", "arn:aws:s3:::$b/*"); Condition = @{ Bool = @{ 'aws:SecureTransport' = 'false' } } }) } | ConvertTo-Json -Depth 6 | Set-Content https-only.json
aws s3api put-bucket-policy --bucket $b --policy file://https-only.json
aws s3 cp "s3://$b/reports/jan.csv" - --profile saat-reader
function Get-HttpCode([string]$Url) { try { (Invoke-WebRequest $Url -UseBasicParsing).StatusCode } catch { [int]$_.Exception.Response.StatusCode } }
Get-HttpCode "http://$b.s3.ap-south-1.amazonaws.com/reports/jan.csv"

You should see something like this:

month,total
403

The CLI over HTTPS still works; a plain HTTP request is refused by the explicit deny (it would be refused anyway because it’s anonymous, but now even signed HTTP requests are). When a deny like this blocks a real app, the message says “explicit deny in a resource-based policy”.

✅ Checkpoint: The reader reads jan.csv, gets 403 then 404 for feb.csv once ListBucket is added, and the HttpsOnly bucket policy is in place.