Access denied to S3 bucket from AWS CLI

Question

Hi,

I'm able to access a S3 bucket from the console. But when I try to use AWS CLI command 'aws s3 ls s3:///, I get message 'An error occurred (AccessDenied) when calling the ListObjectsV2 operation: Access Denied'. The CLI profile region is the same as the S3 bucket region. The access key and secret access key are all correct. What could I have missed? Thanks.

Accepted Answer

Thanks all for your advice. Root cause was identified and issue was resolved now. The MFA was enforced in CLI and temporary token was not setup in the profile hence unable to access the AWS services from CLI. The MFA enforcement has been removed for the AWS service I need to access in CLI and it's working now.

Answer

Hi,
You should verify that your cli profile is known:
```
aws configure list-profiles
```
then check the identity under which you will run your cli command:

```
aws sts get-caller-identity
```

Finally, you may run
```
aws sts get-caller-identity --profile (name of the profile you want to view)
```

Answer

Hi,

Could you check if your IAM user has the required permission to access the bucket?
You will need a policy similar to the following to access the bucket objects

```json
{
  "Version": "2012-10-17",
  "Statement": [
      {
          "Effect": "Allow",
          "Action": [
              "s3:ListBucket"
          ],
          "Resource": [
              "arn:aws:s3:::bucketname"
          ]
      },
      {
          "Effect": "Allow",
          "Action": [
              "s3:GetObject"
          ],
          "Resource": [
              "arn:aws:s3:::bucketname/*"
          ]
      }
  ]
}
```

Access denied to S3 bucket from AWS CLI

Relevant content