Solve - S3 Access Denied when calling ListObjectsV2

avatar

Borislav Hadzhiev

Mon Sep 27 20212 min read

banner

Photo by Frank Mckenna

Solve - S3 Access Denied when calling ListObjectsV2 #

The S3 error "(AccessDenied) when calling the ListObjectsV2 operation" occurs when we try to list the objects in an S3 bucket without having the necessary permissions.

access denied error

To solve the "(AccessDenied) when calling the ListObjectsV2 operation" error attach a policy that allows the ListBucket action on the bucket itself and the GetObject action on all of the bucket's objects to the IAM entity (user or role) that is trying to access the S3 bucket.

Edit the IAM entity (user or role), that grants permissions to the bucket and add the following policy.

Make sure to replace the YOUR_BUCKET placeholder with the name of your S3 bucket.
allow-listobjectsv2-policy.json
{ "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "s3:GetObject" ], "Resource": [ "arn:aws:s3:::YOUR_BUCKET/*" ] }, { "Effect": "Allow", "Action": [ "s3:ListBucket" ], "Resource": [ "arn:aws:s3:::YOUR_BUCKET" ] } ] }

The first statement in the JSON policy allows the GetObject action on individual objects in sub-directories of the bucket.

The second statement in the policy allows the ListBucket permission. It allows the IAM entity to list all of the bucket's objects.

After the IAM policy has been attached to the IAM user or role, which is trying to list the bucket's objects the error should be resolved.
Note that S3 is a globally distributed service and it might take a minute or two for the policy to take effect.

If the error is not resolved, you have to verify that the bucket policy does not deny access to the ListBucket or GetObject actions and that it does not have a condition that only allows a specific IP range to access the bucket's objects:

  1. Open your AWS S3 console and click on your bucket's name

  2. Click on the Permissions tab and scroll down to the Bucket Policy section

  3. Verify that your bucket policy does not deny the ListBucket or GetObject actions. An explicit Deny statement always overrides Allow statements.

If the bucket policy does not Deny the ListBucket or GetObject actions, but you still are unable to list your bucket's objects, add the following Bucket policy in the editor.

Make sure to replace the YOUR_BUCKET, YOUR_ACCOUNT_NUMBER, YOUR_USERNAME placeholders with real values.
bucket-policy.json
{ "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Principal": { "AWS": "arn:aws:iam::YOUR_ACCOUNT_NUMBER:user/YOUR_USERNAME" }, "Action": "s3:GetObject", "Resource": "arn:aws:s3:::YOUR_BUCKET/*" }, { "Effect": "Allow", "Principal": { "AWS": "arn:aws:iam::YOUR_ACCOUNT_NUMBER:user/YOUR_USERNAME" }, "Action": "s3:ListBucket", "Resource": "arn:aws:s3:::YOUR_BUCKET" } ] }

In the bucket policy above, we've allowed the GetObject and ListObject actions to a specific user in the account (the Principal field).

This policy allows an IAM user to invoke the GetObject and ListObject actions on the bucket, even if they don't have a policy which permits them to do that.

Further Reading #

Join my newsletter

I'll send you 1 email a week with links to all of the articles I've written that week

Buy Me A Coffee