Question: Why can't I access a specific folder or file in my Amazon S3 bucket?

I can't access a certain prefix or object that's in my Amazon Simple Storage Service (Amazon S3) bucket. I can access the rest of the data in the bucket. How can I fix this?Short descriptionCheck the following permissions for any settings that are denying your access to the prefix or object:Ownership of the prefix or objectRestrictions in the bucket policyRestrictions in your AWS Identity and Access Management (IAM) user policyPermissions to object encrypted by AWS Key Management Service (AWS KMS)Also, note the following:If the object is encrypted using an AWS managed KMS key, only the AWS account that encrypted the object can read it.If permissions boundaries and sessions policies are defined, the maximum permissions of the requester can be impacted. As a result, there might also be impact to object access.Restrictions might be specified in other policies such as VPC endpoint policies and service control policies (SCPs). Therefore, check these policies and update them accordingly.You can also control ownership of uploaded objects using Amazon S3 Object Ownership. If Object Ownership is set to "BucketOwnerPreferred", objects that are newly written by other accounts with the bucket-owner-full-control canned ACL transition to the bucket owner.

ResolutionOwnership of the prefix or objectBy default, an S3 object is owned by the AWS account that uploaded it. This is true even when the bucket is owned by another account. If other accounts can upload to your bucket, follow these steps to get permissions to the object or prefix that you can't access:1.    Run this AWS Command Line Interface (AWS CLI) command to get the Amazon S3 canonical ID for your account:aws s3api list-buckets --query Owner.IDNote: If you receive errors when running AWS CLI commands, make sure that you’re using the most recent version of the AWS CLI.2.    Run this command to get the Amazon S3 canonical ID of the account that owns the object you can't access:aws s3api list-objects --bucket DOC-EXAMPLE-BUCKET --prefix index.html3.    If the canonical IDs don't match, then you (the bucket owner) don't own the object. For an individual object, the object owner can grant you full control by running this put-object-acl command:aws s3api put-object-acl --bucket DOC-EXAMPLE-BUCKET --key object-name --acl bucket-owner-full-controlFor objects within a prefix, the object owner must re-copy the prefix and grant you full control of the objects as part of the operation. For example, the object owner can run this cp command with the --acl bucket-owner-full-control parameter:aws s3 cp s3://DOC-EXAMPLE-BUCKET/abc/ s3://DOC-EXAMPLE-BUCKET/abc/ --acl bucket-owner-full-control --recursive --storage-class STANDARDTip: You can use a bucket policy to require that other accounts grant you ownership of objects they upload to your bucket.Restrictions in the bucket policy1.    Open the Amazon S3 console.2.    From the list of buckets, open the bucket with the policy that you want to review.3.    Choose the Permissions tab.4.    Choose Bucket policy.5.    Search for statements with "Effect": "Deny". Then, review those statements for references to the prefix or object that you can't access.For example, this bucket policy denies everyone access to the abc/* prefix in DOC-EXAMPLE-BUCKET:{    "Version": "2012-10-17",    "Statement": [        {            "Sid": "StatementPrefixDeny",            "Effect": "Deny",            "Principal": {                "AWS": "*"            },            "Action": "s3:*",            "Resource": "arn:aws:s3:::DOC-EXAMPLE-BUCKET/abc/*"        }    ]}6.     Modify the bucket policy to edit or remove any "Effect": "Deny" statements that are incorrectly denying you access to the prefix or object.Restrictions in your IAM user policy1.    Open the IAM console.2.    From the console, open the IAM user or role that you're using to access the prefix or object.3.    In the Permissions tab of your IAM user or role, expand each policy to view its JSON policy document.4.    In the JSON policy documents, search for policies related to Amazon S3 access. Then, search those policies for any "Effect": "Deny" statements that are blocking your access to the prefix or object.For example, the following IAM policy has an "Effect": "Deny" statement that blocks the IAM identity's access to the prefix abc/* within DOC-EXAMPLE-BUCKET. Then, the policy also has an "Effect": "Allow" statement that grants access to DOC-EXAMPLE-BUCKET. Despite the allow statement for the entire bucket, the explicit deny statement prevents the IAM identity from accessing the prefix abc/*.{    "Version": "2012-10-17",    "Statement": [        {            "Sid": "StatementPrefixDeny",            "Effect": "Deny",            "Action": "s3:GetObject",            "Resource": [                "arn:aws:s3:::DOC-EXAMPLE-BUCKET/abc/*"            ]        },        {            "Sid": "StatementFullPermissionS3",            "Effect": "Allow",            "Action": "s3:GetObject",            "Resource": [                "arn:aws:s3:::DOC-EXAMPLE-BUCKET",                "arn:aws:s3:::DOC-EXAMPLE-BUCKET/*"            ]        }    ]}5.    Modify the policy to edit or remove any "Effect": "Deny" statements that are incorrectly denying you access to the prefix or object.Permissions to object encrypted by AWS KMSIf an object is encrypted with an AWS KMS key, then you need permissions to both the object and the key. Follow these steps to check if you can't access the object because you need permissions to an AWS KMS key:1.    Use the Amazon S3 console to view the properties of one of the objects that you can't access. Review the object's Encryption properties.2.    If the object is encrypted with a custom AWS KMS key (KMS key), then review the KMS key policy. Confirm that the key policy allows your IAM identity to perform the following KMS actions:"Action": ["kms:Decrypt"]3.    If your IAM identity is missing permissions to any of these actions, modify the key policy to grant the missing permissions.Important: If your IAM identity and KMS key belong to different accounts, then check to make sure that you have proper permissions. Both your IAM and key policies must grant you permissions to the required KMS actions.

Related informationWhy can't I access an object that was uploaded to my Amazon S3 bucket by another AWS account?How can I grant a user access to a specific folder in my Amazon S3 bucket?Do I need to specify the AWS KMS key when I download a KMS-encrypted object from Amazon S3?