An error occurred (AccessDenied) when calling the GetPublicAccessBlock operation: Access Denied

Hi Mark,

I’ve tested this in my own account for you. By interrogating the ‘get-public-access-block’ api call, it seems that when an S3 bucket is created via the CLI, no public access block configuration is created, unless you specify it. When I enable public access block and then remove it, I can see the equivalent of an explicit allow.

So rather, Public access is not enabled by default on buckets created in the console, but is enabled when created via CLI.

[ec2-user@ip-172-31-41-17 ~]$ aws s3 mb s3://publicblocktest123

make_bucket: publicblocktest123

[ec2-user@ip-172-31-41-17 ~]$ aws s3api get-public-access-block --bucket publicblocktest123

An error occurred (NoSuchPublicAccessBlockConfiguration) when calling the GetPublicAccessBlock operation: The public access block configuration was not found

I then disabled and enabled public block access

[ec2-user@ip-172-31-41-17 ~]$ aws s3api get-public-access-block --bucket publicblocktest123 

{  "PublicAccessBlockConfiguration": 

{ 

 "IgnorePublicAcls": false, 

 "BlockPublicPolicy": false, 

 "BlockPublicAcls": false, 

 "RestrictPublicBuckets": false 

 } 

 }

Solving - S3 Access Denied when calling PutObject #

The S3 error "(AccessDenied) when calling the PutObject operation" occurs when we try to upload a file to an S3 bucket without having the necessary permissions.

In order to solve the "(AccessDenied) when calling the PutObject operation" error:

1. Open the AWS S3 console and click on your bucket's name.
2. Click on the Permissions tab and scroll down to the Block public access (bucket settings) section.
3. If you are uploading files and making them publicly readable by setting their acl to public-read, verify that creating new public ACLs is not blocked in your bucket. Save and confirm the changes.

1. On the same page, scroll down to the Bucket Policy section and verify that your bucket policy does not Deny the PutObject action or have a Condition that prevents you from uploading files, e.g. an IP restriction

2. Verify that you are not misspelling the name of the bucket when uploading files. E.g. in this example I try to upload a file to a bucket named hello. Since I don't own this bucket, I get the "(AccessDenied) when calling the PutObject operation" error

1. Open the permissions policy, attached to your IAM entity (the user or role) that is responsible for granting the PutObject permissions and verify that it has the following actions allowed:

Make sure to replace the YOUR_BUCKET placeholder with the name of your s3 bucket.

Don't attach this policy as a bucket policy. Rather attach it to the user that is trying to upload files to the S3 bucket or to the corresponding role (e.g. of a lambda function or EC2 instance).

Copied!

Note that S3 is a globally distributed service and it might take a minute or two for the policy to take effect.

Once the policy is attached to the IAM entity, you will be able to upload files to your S3 bucket.

Further Reading #

• Get the Size of a Folder in AWS S3 Bucket
• How to Get the Size of an AWS S3 Bucket
• Add a Bucket Policy to an AWS S3 Bucket
• Configure CORS for an AWS S3 Bucket
• Allow Public Read access to an AWS S3 Bucket
• Copy a Local Folder to an S3 Bucket
• Download a Folder from AWS S3
• How to Rename a Folder in AWS S3
• Copy Files and Folders between S3 Buckets
• How to Delete a Folder from an S3 Bucket
• Count Number of Objects in S3 Bucket
• Download an Entire S3 Bucket - Complete Guide
• AWS CDK Tutorial for Beginners - Step-by-Step Guide
• How to use Parameters in AWS CDK