S3 Bucket without ACL - No permission

Question

I found an issue with a S3 bucket.

The bucket don't have any ACL associated, and the user that create the bucket was deleted.

How it's possible add some ACL in the bucket to get the control back?

For any command using AWS CLI, the result are the same always: An error occurred (AccessDenied) when calling the operation: Access Denied

Also in AWS console the access is denied.

Answer 1

First things first , AccessDenied error in AWS indicates that your AWS user does not have access to S3 service , Get S3 permission to your IAM user account , if in case you had access to AWS S3 service.

The thing is since you are using cli make sure AWS client KEY and secret are still correctly in local.

Now the interesting use case :

You have access to S3 service but cannot access the bucket since the bucket had some policies set

In this case if user who set the policies left and no user was able to access this bucket, the best way is to ask AWS root account holder to change the bucket permissions

Answer 2

An IAM user with the managed policy named AdministratorAccess should be able to access all S3 buckets within the same AWS account. Unless you have applied some unusual S3 bucket policy or ACL, in which case you might need to log in as the account's root user and modify that bucket policy or ACL.

See Why am I getting an "Access Denied" error from the S3 when I try to modify a bucket policy ?

Answer 3

I just posted this on a related thread...

https://stackoverflow.com/a/73977525/999943

https://aws.amazon.com/premiumsupport/knowledge-center/s3-bucket-owner-full-control-acl/

Basically when putting objects from the non-bucket owner, you need to set the acl at the same time.

 --acl bucket-owner-full-control