Debug: AWS S3 access denied troubleshooting

S3 operations fail with AccessDenied even though IAM policy looks correct.

S3 access denied has many possible causes:

1. Check IAM policy:

aws iam get-user # Who am I?
aws sts get-caller-identity # What role/user?

# Policy must allow the specific action:
s3:GetObject, s3:PutObject, s3:ListBucket, s3:DeleteObject
# ListBucket is on the BUCKET, GetObject is on OBJECTS:
{
"Effect": "Allow",
"Action": "s3:ListBucket",
"Resource": "arn:aws:s3:::my-bucket"
},
{
"Effect": "Allow",
"Action": ["s3:GetObject", "s3:PutObject"],
"Resource": "arn:aws:s3:::my-bucket/*"
}

1. Bucket policy might DENY:

aws s3api get-bucket-policy --bucket my-bucket
# Explicit deny overrides any allow

1. Block Public Access settings:

aws s3api get-public-access-block --bucket my-bucket
# Can block even if policy allows

1. Encryption requirements:

# Bucket requires SSE but upload doesn't specify it
aws s3 cp file.txt s3://bucket/ --sse AES256

1. VPC endpoint policy:

# If accessing from VPC, endpoint policy may restrict

1. Object ownership:

# Objects uploaded by other accounts may not be accessible
# Fix: bucket-owner-full-control ACL on upload

1. MFA delete enabled:

# Requires MFA for delete operations