3

I've created an AWS S3 bucket to backup my Postgres DB. It was all going well but then I enabled Logging and started to get a bunch of Access Denied logs.

I thought I had messed something up in my backup routine, so I created a brand new bucket under a new name and just enabled the logging, but did nothing else. And now I'm getting the Access Denied logs again.

They read:

<Error>
  <Code>AccessDenied</Code>
  <Message>Access Denied</Message>
  <RequestId>...</RequestId>
  <HostId>
    ...
  </HostId>
</Error>

Under Permissions, I am the only authorized user, with full access, and there's also the S3 log delivery group with write and read permissions.

Any ideas on what's causing these access denied requests? I have to stress that I haven't tried to do anything with this bucket, I just created it and enabled logging. (I am new to AWS S3 so I might be missing something very simple.)

  • It could be someone trying to access your bucket with randomly generated bucket names. You haven't given us enough information to give you any concrete information - include a few of the full errors in your post if you want more help. – Tim Aug 22 '17 at 20:17
  • @Tim the errors are all the same as the one above, except all have different HostIds. They also happen in bursts of roughly 5 errors per minute for about 3 minutes, then stop for 2 minutes or so and start again. – bplmp Aug 22 '17 at 20:25
  • S3 buckets exist in one big namespace. Is it possible you picked a name that might be common and someone else maybe is trying to use it also? – c3st7n Aug 22 '17 at 20:35
  • @c3st7n Not sure if this is the case... Both of the bucket names I am using are 18-20 characters in length and do not contain common words. But I will try to create another bucket with a long, random name and see if the error is reproducible. – bplmp Aug 22 '17 at 21:01
  • @c3st7n I think you were right. My random UUID bucket is getting no access denied attempts, while the other one has gotten more than 150 in a couple of hours. I will now prefix my bucket names with a UUID. – bplmp Aug 22 '17 at 21:37
1

As Michael says in the comments, this is message telling YOU that YOU'RE denied access to this log file as it's trying to load in the browser.

Try clicking the "Download" button for this object in the S3 interface. You should get a text file with the actual log in it.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.