将文件从 AWS S3 下载到本地文件时出现客户端错误 (403)

Question

I uploaded several .zip files to my AWS S3 bucket a while back using the AWS CLI. Now I can't seem to download those files when using the following command:

aws s3 cp s3://mybucket/test.zip test2.zip

because it yields the following error:

A client error (403) occurred when calling the HeadObject operation: Forbidden
Completed 1 part(s) with ... file(s) remaining

How can I resolve this issue?

Edit:

Running the following command shows the existing bucket policies

aws s3api get-bucket-policy --bucket mybucket

---

{
    "Policy": "{\"Version\":\"2012-10-17\",\"Statement\":[{\"Sid\":\"Example permissions\",\"Effect\":\"Allow\",\"Principal\":{\"AWS\":\"arn:aws:iam::221234567819:root\"},\"Action\":[\"s3:ListBucket\",\"s3:GetBucketLocation\"],\"Resource\":\"arn:aws:s3:::mybucket\"},{\"Sid\":\"Examplepermissions\",\"Effect\":\"Allow\",\"Principal\":{\"AWS\":\"arn:aws:iam::221234567819:root\"},\"Action\":[\"s3:PutObject\",\"s3:AbortMultipartUpload\",\"s3:PutObjectAcl\",\"s3:GetObject\",\"s3:DeleteObject\",\"s3:GetObjectAcl\",\"s3:ListMultipartUploadParts\",\"s3:PutObjectAcl\"],\"Resource\":\"arn:aws:s3:::mybucket/*\"}]}"
}

Answer 1

This is most likely one of three causes:

1. either that one of your policies is not permitting you to read the resources (yes, it's possible to have write permissions but not read permissions), or
2. that your client environment is no longer setup with the correct credentials.
3. you don't have ListBucket permission and the file is not present (it returns 403 instead of 404, as if you don't have ListBucket, you shouldn't be able to tell if a file exists or not).

For 1, S3 objects can be secured by either Bucket Policies, User Policies or ACLs and there are complex interactions between the 3. See http://docs.aws.amazon.com/AmazonS3/latest/dev/s3-access-control.html for more details.

If you update your question with details of relevant user polices, bucket policies and ACLs I could take a look and see if anything explains the symptom.

Edit:

Reviewing the included bucket policy, it appears to be tied to the root principal. Are you using root credentials for the aws s3 cli? If you are using an IAM user, you will need to modify the Principal (See http://docs.aws.amazon.com/AmazonS3/latest/dev/s3-bucket-user-policy-specifying-principal-intro.html )

Answer 2

Add "arn:aws:s3:::your-bucket-name" together with "arn:aws:s3:::your-bucket-name/*" to Recourses in your policy. Also, you may need non-obvious "s3:ListBucket" permission and maybe some other permissions.

My policy that works for downloading files in lambda function:

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "VisualEditor",
            "Effect": "Allow",
            "Action": [
                "s3:GetObject",
                "s3:ListBucket"
            ],
            "Resource": [
                "arn:aws:s3:::XXXXX-pics",
                "arn:aws:s3:::XXXXX-pics/*"
            ]
        }
    ]
}

It is attached to the Lambda function role. No bucket policy attached to the bucket was needed.