AWS S3 ListObjects Access Denied error can be resolved easily with these troubleshooting tips by our experts.

At Bobcares, we offer solutions for every query, big and small, as a part of our AWS Support Services.

Let’s take a look at how our AWS Support Team is ready to help customers troubleshoot AWS S3 ListObjects Access Denied.

All about AWS S3 ListObjects Access Denied Error

Have you been coming across the following error while trying to access your AWS S3 bucket?

An error occurred (AccessDenied) when calling the ListObjects operation: Access Denied

Each time an AWS S3 sync command is run, it leads to the Amazon S3 listing the source and destination in order to verify the object exists.

In other words, it results in the following API calls: CopyObject, ListObjectsV2, PutObject, and GetObject.

• CopyObject API call for the bucket to bucket operation
• PutObject API for local to bucket operation
• GetObject API for the bucket to local operation

The Access Denied error occurs due to not having the required permissions to perform actions on the bucket. Fortunately, there is an easy resolution AWS S3 ListObjects operation Access Denied error.

How to resolve AWS S3 ListObjects Access Denied

According to our AWS experts, the fix for this specific issue involves configuring the IAM policy.

To begin with, we have to ensure that we have permission to list objects in the bucket as per the IAM and bucket policies if the IAM user or role belongs to another AWS account.

However, if the user or role belongs to the bucket owner’s account, we need permission only from IAM or the bucket policy.

Additionally, our AWS experts suggest checking other policy statements for explicit denial of action.

For instance, here is a sample IAM policy that offers permission to s3:ListBucket

s3:ListBucket- Name of the permission that permits a user to list objects in the bucket.

ListObjectsV2- Name of the API call that lists objects in the bucket.

    "Action": "s3:ListBucket",
    "Effect": "Allow",
    "Resource": "arn:aws:s3:::AWSDOC-SAMPLE-BUCKET"
  }]
}

Moreover, here is a sample bucket policy that offers user arn:aws:iam::202204295674:user/user1 access to s3:ListBucket:

{
  "Id": "Policy1546414473940",
  "Version": "2012-10-17",
  "Statement": [{
    "Sid": "Stmt1546414471931",
    "Action": "s3:ListBucket",
    "Effect": "Allow",
    "Resource": "arn:aws:s3:::AWSDOC-SAMPLE-BUCKET",
    "Principal": {
      "AWS": [
        "arn:aws:iam::202204295674:user/user1"
      ]
    }
  }]
}

Checking ListObjectV2 permission

If the Request Pays is enabled and our bucket belongs to another user, we have ot check whether the IAM and bucket policies both offer ListObjectsV2 permissions. If yes, verify the sync command syntax. In fact, one of our customers came across the AWS S3 Access Denied ListObjects error due to an incorrect sync command syntax.

Here is a quick look at the sync command syntax when Request Pays is enabled:

aws s3 sync ./ s3://requester-pays-bucket/ --request-payer requester

However, if we are still facing the error, it is time to attach a policy that permits ListBucket action on the bucket as well as GetObject action on bucket objects to the IAM user or role with S3 bucket access.

 {
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "s3:GetObject"
            ],
            "Resource": [
                "arn:aws:s3:::OUR_BUCKET/*"
            ]
        },
        {
            "Effect": "Allow",
            "Action": [
                "s3:ListBucket"
            ],
            "Resource": [
                "arn:aws:s3:::OUR_BUCKET"
            ]
        }
    ]
}

Alternatively, our AWS experts suggest verifying that the policy does not restrict access to GetObject or ListObject action. Furthermore, check if there is a condition that permits only a particular IP range to access bucket objects.

[Need assistance with another query? We are available 24/7.]

Conclusion

In a nutshell, our skilled AWS Support Engineers at Bobcares demonstrated how to troubleshoot and resolve AWS S3 ListObjects Access Denied error.