S3 Access Denied when calling PutObject

S3 Access Denied when calling PutObject #

The S3 error "(AccessDenied) when calling the PutObject operation" occurs when we try to upload a file to an S3 bucket without having the necessary permissions.

putobject error

In order to solve the "(AccessDenied) when calling the PutObject operation" error:

Open the AWS S3 console and click on your bucket's name.
Click on the Permissions tab and scroll down to the Block public access (bucket settings) section.
If you are uploading files and making them publicly readable by setting their acl to public-read, verify that creating new public ACLs is not blocked in your bucket. Save and confirm the changes.

verify-not-blocking-acls

On the same page, scroll down to the Bucket Policy section and verify that your bucket policy does not Deny the PutObject action or have a Condition that prevents you from uploading files, e.g. an IP restriction
Verify that you are not misspelling the name of the bucket when uploading files. E.g. in this example, I try to upload a file to a bucket named hello. Since I don't own this bucket, I get the "(AccessDenied) when calling the PutObject operation" error

wrong bucket name

Open the permissions policy, attached to your IAM entity (the user or role) that is responsible for granting the PutObject permissions and verify that it has the following actions allowed:

Make sure to replace the YOUR_BUCKET placeholder with the name of your s3 bucket.

Don't attach this policy as a bucket policy. Rather attach it to the user that is trying to upload files to the S3 bucket or to the corresponding role (e.g. of a lambda function or EC2 instance).

putobject-policy.json

Copied!
{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Action": [
                "s3:PutObject",
                "s3:PutObjectAcl",
                "s3:GetObject",
                "s3:GetObjectAcl",
                "s3:AbortMultipartUpload"
            ],
            "Resource": [
                "arn:aws:s3:::YOUR_BUCKET",
                "arn:aws:s3:::YOUR_BUCKET/*"
            ],
            "Effect": "Allow"
        }
    ]
}

Note that S3 is a globally distributed service and it might take a minute or two for the policy to take effect.

Once the policy is attached to the IAM entity, you will be able to upload files to your S3 bucket.

successfully put object

S3 Access Denied when calling PutObject

S3 Access Denied when calling PutObject #

Further Reading #

Borislav Hadzhiev