Just created S3 bucket, getting a bunch of access denied logs

amazon s3amazon-web-services

I've created an AWS S3 bucket to backup my Postgres DB. It was all going well but then I enabled Logging and started to get a bunch of Access Denied logs.

I thought I had messed something up in my backup routine, so I created a brand new bucket under a new name and just enabled the logging, but did nothing else. And now I'm getting the Access Denied logs again.

They read:

<Error>
  <Code>AccessDenied</Code>
  <Message>Access Denied</Message>
  <RequestId>...</RequestId>
  <HostId>
    ...
  </HostId>
</Error>

Under Permissions, I am the only authorized user, with full access, and there's also the S3 log delivery group with write and read permissions.

Any ideas on what's causing these access denied requests? I have to stress that I haven't tried to do anything with this bucket, I just created it and enabled logging. (I am new to AWS S3 so I might be missing something very simple.)

Best Answer

As Michael says in the comments, this is message telling YOU that YOU'RE denied access to this log file as it's trying to load in the browser.

Try clicking the "Download" button for this object in the S3 interface. You should get a text file with the actual log in it.

Related Solutions

Access Denied when calling the CreateInvalidation operation on AWS CLI

IAM Policies do not allow restriction of access to specific CloudFront distributions. The solution is to use a wildcard for the resource, instead of only referencing a specific CloudFront resource. Adding that to your IAM policy will fix the issue you're having.

Here is an example of that in a working IAM policy:

{
  "Statement": [  
    {
      "Effect": "Allow",
      "Action": "s3:*",
      "Resource": "arn:aws:s3:::*"
    },
    {
      "Effect": "Allow",
      "Action": [
        "cloudfront:CreateInvalidation",
        "cloudfront:GetInvalidation",
        "cloudfront:ListInvalidations"
      ],
      "Resource": "*"
    }
  ]
}

Docs:

Access Denied when syncing between s3 buckets on different AWS accounts

The cause of your ListObjects error is that you assigned permission to access the contents of your bucket (arn:aws:s3:::bucket/*) but you did not give permissions to the bucket itself (arn:aws:s3:::bucket). The ListObjects command requires access to the bucket.

To test this, I did the following:

Used two AWS accounts: Account A, Account B
Created bucket-a in Account A
Created bucket-b in Account B
Created an IAM User user-a in Account A with permissions to access bucket-a

Added a Bucket Policy to bucket-b:

{
  "Id": "CopyBuckets",
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "Stmt1",
      "Action": "s3:*",
      "Effect": "Allow",
      "Resource": [
        "arn:aws:s3:::bucket-b",
        "arn:aws:s3:::bucket-b/*"
      ],
      "Principal": {
        "AWS": [
          "arn:aws:iam::<account-a-id>:user/user-a"
        ]
      }
    }
  ]
}

I then triggered the sync by using user-a in Account A:

aws s3 sync s3://bucket-a s3://bucket-b --profile user-a

It worked successfully.

Best Answer

Related Solutions

Access Denied when calling the CreateInvalidation operation on AWS CLI

Access Denied when syncing between s3 buckets on different AWS accounts

Related Topic