Solve - S3 Access Denied when calling PutObject

avatar

Borislav Hadzhiev

Mon Sep 27 20212 min read

Solving - S3 Access Denied when calling PutObject #

The S3 error "(AccessDenied) when calling the PutObject operation" occurs when we try to upload a file to an S3 bucket without having the necessary permissions.

putobject error

In order to solve the "(AccessDenied) when calling the PutObject operation" error:

  1. Open the AWS S3 console and click on your bucket's name
  2. Click on the Permissions tab and scroll down to the Block public access (bucket settings) section
  3. If you are uploading files and making them publicly readable by setting their acl to public-read, verify that creating new public ACLs is not blocked in your bucket. Save and confirm the changes.

verify-not-blocking-acls

  1. On the same page scroll down to the Bucket Policy section and verify that your bucket policy does not Deny the PutObject action or have a Condition that prevents you from uploading files, e.g. an IP restriction

  2. Verify that you are not misspelling the name of the bucket when uploading files. E.g. in this example I try to upload a file to a bucket named hello. Since I don't own this bucket, I get the "(AccessDenied) when calling the PutObject operation" error

wrong bucket name

  1. Open the permissions policy, attached to your IAM entity (the user or role) that is responsible for granting the PutObject permissions and verify that it has the following actions allowed:
Make sure to replace the YOUR_BUCKET placeholder with the name of your s3 bucket.
Don't attach this policy as a bucket policy, rather attach it to the user that is trying to upload files to the S3 bucket or to the corresponding role (e.g. of a lambda function or EC2 instance).
putobject-policy.json
{ "Version": "2012-10-17", "Statement": [ { "Action": [ "s3:PutObject", "s3:PutObjectAcl", "s3:GetObject", "s3:GetObjectAcl", "s3:AbortMultipartUpload" ], "Resource": [ "arn:aws:s3:::YOUR_BUCKET", "arn:aws:s3:::YOUR_BUCKET/*" ], "Effect": "Allow" } ] }
Note that S3 is a globally distributed service and it might take a minute or two for the policy to take effect.

Once the policy is attached to the IAM entity you will be able to upload files to your S3 bucket.

successfully put object

Further Reading #

Join my newsletter

I'll send you 1 email a week with links to all of the articles I've written that week

Buy Me A Coffee