I have a user, I'll call Alfred User, with attached IAM policy as follows

    "Version": "2012-10-17",
    "Statement": [
            "Effect": "Allow",
            "Action": [
            "Resource": [

In the IAM simulator, I get "Allowed" for GetObject, using this policy, and this ARN: arn:aws:s3:::my-bucket-name/my-object.xml

On the CLI, I get AccessDenied for the following command: aws s3 cp s3://my-bucket-name/my-object.xml temp/my-object.xml

A client error (AccessDenied) occurred when calling the GetObject operation: Access Denied

I've looked at everything I can think of but I can't explain this discrepancy. What am I missing?

Things I've tried

"creds" here mean "AWS IAM access keys"

  • IAM simulator -- this works
  • A different set of IAM creds -- this works
  • Using aws s3 ls s3://my-bucket-name/ -- this works with Alfred's IAM creds and with my creds
  • Compared policies to a similarly configured bucket in a different AWS account. The policies are identical, near as I can tell.
  • do you have access_key_id and secret_access_key defined somewhere?
    – 13dimitar
    Jan 18, 2017 at 12:01
  • yes. that's not the problem. i'll add that to the oq
    – JDS
    Jan 18, 2017 at 12:16
  • Does the bucket itself have a bucket policy? A conflicting Deny, there would override an Allow elsewhere. Jan 18, 2017 at 13:27
  • there is no separate bucket policy i looked at this, too. plus, if this were true then the creds I have that work wouldn't work
    – JDS
    Jan 18, 2017 at 16:05

1 Answer 1


Turns out it was permissions on the KMS key(s) that encrypt this bucket. The keys are owned by the root account, and as such I couldn't find them with my normal IAM access, nor could I see the policy on them.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .