S3 Access Denied when calling PutObject

avatar

Borislav Hadzhiev

Last updated: Jul 25, 2022

banner

Photo from Unsplash

S3 Access Denied when calling PutObject #

The S3 error "(AccessDenied) when calling the PutObject operation" occurs when we try to upload a file to an S3 bucket without having the necessary permissions.

putobject error

In order to solve the "(AccessDenied) when calling the PutObject operation" error:

  1. Open the AWS S3 console and click on your bucket's name.
  2. Click on the Permissions tab and scroll down to the Block public access (bucket settings) section.
  3. If you are uploading files and making them publicly readable by setting their acl to public-read, verify that creating new public ACLs is not blocked in your bucket. Save and confirm the changes.

verify-not-blocking-acls

  1. On the same page, scroll down to the Bucket Policy section and verify that your bucket policy does not Deny the PutObject action or have a Condition that prevents you from uploading files, e.g. an IP restriction

  2. Verify that you are not misspelling the name of the bucket when uploading files. E.g. in this example, I try to upload a file to a bucket named hello. Since I don't own this bucket, I get the "(AccessDenied) when calling the PutObject operation" error

wrong bucket name

  1. Open the permissions policy, attached to your IAM entity (the user or role) that is responsible for granting the PutObject permissions and verify that it has the following actions allowed:
Make sure to replace the YOUR_BUCKET placeholder with the name of your s3 bucket.
Don't attach this policy as a bucket policy. Rather attach it to the user that is trying to upload files to the S3 bucket or to the corresponding role (e.g. of a lambda function or EC2 instance).
putobject-policy.json
{ "Version": "2012-10-17", "Statement": [ { "Action": [ "s3:PutObject", "s3:PutObjectAcl", "s3:GetObject", "s3:GetObjectAcl", "s3:AbortMultipartUpload" ], "Resource": [ "arn:aws:s3:::YOUR_BUCKET", "arn:aws:s3:::YOUR_BUCKET/*" ], "Effect": "Allow" } ] }
Note that S3 is a globally distributed service and it might take a minute or two for the policy to take effect.

Once the policy is attached to the IAM entity, you will be able to upload files to your S3 bucket.

successfully put object

Further Reading #

I wrote a book in which I share everything I know about how to become a better, more efficient programmer.
book cover
You can use the search field on my Home Page to filter through all of my articles.