S3 object downloads work, but listing the bucket returns AccessDenied

An example service can retrieve a known object key but cannot enumerate the same bucket. The role policy was written specifically for object reads, and the application recently added a directory-style browser. Does successful GetObject access imply that the list request should also work?

No. Listing a bucket and reading an object are different API operations with different permissions and resource scopes. Identify the failing list call and inspect the relevant bucket-level permission and any prefix conditions. Do not replace the existing narrow policy with full S3 access merely because the application added a new operation.

If browsing is an intended feature, propose a scoped list permission that matches the required bucket and prefixes. Check for explicit denies and endpoint restrictions too. Verify both the permitted listing and a path that should remain unavailable after the change.

Can we keep downloads limited to one prefix while enabling only the matching list view?

That is the policy intent to evaluate. The list request’s conditions and the object resource scope must both match the prefix boundary; test their behavior separately.

Application design may avoid listing altogether if it already has an authorized index of object keys. Decide whether the new permission is truly required before expanding the access model.

S3 object downloads work, but listing the bucket returns AccessDenied

Sources & further reading

2 answers

Your perspective belongs here.

0 question comments