I have a user, I'll call Alfred User, with attached IAM policy as follows

    "Version": "2012-10-17",
    "Statement": [
            "Effect": "Allow",
            "Action": [
            "Resource": [

In the IAM simulator, I get "Allowed" for GetObject, using this policy, and this ARN: arn:aws:s3:::my-bucket-name/my-object.xml

On the CLI, I get AccessDenied for the following command: aws s3 cp s3://my-bucket-name/my-object.xml temp/my-object.xml

A client error (AccessDenied) occurred when calling the GetObject operation: Access Denied

I've looked at everything I can think of but I can't explain this discrepancy. What am I missing?

Things I've tried

"creds" here mean "AWS IAM access keys"

  • IAM simulator -- this works
  • A different set of IAM creds -- this works
  • Using aws s3 ls s3://my-bucket-name/ -- this works with Alfred's IAM creds and with my creds
  • Compared policies to a similarly configured bucket in a different AWS account. The policies are identical, near as I can tell.
  • do you have access_key_id and secret_access_key defined somewhere?
    – 13dimitar
    Jan 18, 2017 at 12:01
  • yes. that's not the problem. i'll add that to the oq
    – JDS
    Jan 18, 2017 at 12:16
  • Does the bucket itself have a bucket policy? A conflicting Deny, there would override an Allow elsewhere. Jan 18, 2017 at 13:27
  • there is no separate bucket policy i looked at this, too. plus, if this were true then the creds I have that work wouldn't work
    – JDS
    Jan 18, 2017 at 16:05

1 Answer 1


Turns out it was permissions on the KMS key(s) that encrypt this bucket. The keys are owned by the root account, and as such I couldn't find them with my normal IAM access, nor could I see the policy on them.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.