Blog
Bug-Byte #5: Unlocking AWS S3: Overcome Access Denied with Insider Tips
Troubleshooting access to S3 buckets in AWS can be frustrating at times, especially given the generic nature of AWS Access Denied errors. These errors often stem from misconfigured policies on the S3 bucket or IAM principal. However, I have encountered a few more exotic cases in the field.
On the rare occasion that the issue is not policy-related, there are three places that I like to check:
- Does the bucket have server-side encryption (SSE) configured with a customer-managed KMS Key (CMK)?
- Does the traffic to the S3 bucket pass through any VPC S3 endpoints?
- Are you trying to configure a Public S3 bucket when all public access is blocked at the account level?
Server-Side Encryption
If an S3 bucket is configured with SSE and is using a CMK, make sure that the principals who require access to the bucket have been granted the ability to use the following actions in the KMS key policy:
Mar 11, 2024