Access Denied (Service: Amazon S3; Status Code: 403; Error Code: AccessDenied; Request ID: xxxxxxxxxxxxx)

Question

I am trying to access my s3 bucket using a application deployed on my tomcat running on ec2.

I could see lots of posts related to this, but look like most of them complaint about not having proper access. I have proper access to all buckets, I am able to upload the file from another application using different application like jenkins s3 plugin without any issues. I am clueless why this should happen only for a java web application deployed on tomcat. I have confirmed below things.

The ec2 instance was created with an IAM role.
The IAM role has write access to bucket. The puppet scripts is able to write to bucket.
Tried with other application to check the IAM role and it is working fine with out any issues.

As per my understanding if I do not specify any credentials while creating the S3 bucket client(AmazonS3Client ),it will take the IAM role authentication as default.

This is a sample function which I wrote to test the permission.

public boolean checkWritePermission(String bucketName) {
    AmazonS3Client amazonS3Client=new AmazonS3Client();
    LOG.info("Checking bucket write permission.....");
    boolean hasWritePermissions = false;
    final ObjectMetadata metadata = new ObjectMetadata();
    metadata.setContentLength(0);
    // Create empty content
    final InputStream emptyContent = new ByteArrayInputStream(new byte[0]);
    // Create a PutObjectRequest with test object
    final PutObjectRequest putObjectRequest = new PutObjectRequest(bucketName,
            "TestDummy.txt", emptyContent, metadata);
    try {
        if (amazonS3Client.putObject(putObjectRequest) != null) {
            LOG.info("Permissions validated!");
            // User has write permissions, TestPassed.
            hasWritePermissions = true;

        }
    }
    catch (AmazonClientException s3Ex) {
        LOG.warn("Write permissions not available!", s3Ex.getMessage());
        LOG.error("Write permissions not available!", s3Ex);
    }
    return hasWritePermissions;
}

com.amazonaws.services.s3.model.AmazonS3Exception: Access Denied (Service: Amazon S3; Status Code: 403; Error Code: AccessDenied; Request ID: xxxxxxxxxxxxxx).

"As per my understanding...it will take the IAM role authentication." Should we assume from this that your instance actually has an IAM role, and that this role has permission to write to the bucket? — Michael - sqlbot
Yes this instance was created with an IAM role and it has write permission to the bucket. The puppet scripts is able to talk with the bucket. The issue is with using the aws jdk. What I was trying to check is when I instantiate the S3 client AmazonS3Client amazonS3Client=new AmazonS3Client(); if I do not mention any authentication the default one used will be IAM role based? — Harry

pkarfs pkarfs · Accepted Answer · 2020-04-20T12:48:16

Not sure if you have solved this issue yet; however, if you are using custom KMS keys on your bucket and the file you are trying to reach is encrypted with the custom key then this error will also be thrown.

This issue is sometimes hidden by the fact you can still list objects inside your S3 bucket. Make sure your IAM policy includes kms permissions to decrypt.

Access Denied (Service: Amazon S3; Status Code: 403; Error Code: AccessDenied; Request ID: xxxxxxxxxxxxx)

1 Answers