Clienterror: an error occurred (403) when calling the headobject operation: forbidden

I figured it out. I had an error in my cloud formation template that was creating the EC2 instances. As a result, the EC2 instances that were trying to access the above code deploy buckets, were in different regions (not us-west-2). It seems like the access policies on the buckets (owned by Amazon) only allow access from the region they belong in. When I fixed the error in my template (it was wrong parameter map), the error disappeared

Environment

- python 3.7

Error

- An error occurred (404) when calling the HeadObject operation

Situation

- boto3을 사용해 s3에서 파일을 다운로드할 때 해당 에러가 발생한다

import boto3 FILE_PATH = 'image/atv_rider0001.jpg' BUCKET_NAME = 'flxr_yolo' KEY = 'image/atv_rider0001.jpg' client = boto3.client('s3') client.download_file(BUCKET_NAME, KEY, FILE_PATH)

Solution

- Bucket의 이름이 잘못 표기되어 있었다..

- 정확한 이름 : flxr-yolo로 변경하니 제대로 작동한다.

- 다른 자료들을 찾아보니 대부분 경로 설정이나 오타와 같은 단순한 문제였다

Ref

1. https://stackoverflow.com/questions/45109533/aws-cli-s3-copying-file-locally-using-the-terminal-fatal-error-an-error-occu

2. https://stackoverflow.com/questions/46635895/aws-boto3-s3-python-an-error-occurred-404-when-calling-the-head object-operat?rq=1

'Computer Science > 에러 기록 정리' 카테고리의 다른 글

Colab과 Google drive를 사용하면서 일어난 불편한 일들  (4) 2020.06.28
[AWS Lambda]errno 30 read-only file system  (0) 2019.11.13
[boto3]An error occurred (404) when calling the HeadObject operation  (0) 2019.11.13
[boto3]The AWS Access Key Id you provided does not exist in our records.  (0) 2019.11.12
[boto3]ImportError: No module named boto3  (0) 2019.11.12
[keras]UserWarning: The input 10 could not be retrieved. It could be because a worker has died. UserWarning)  (0) 2019.11.07

  1. Home
  2. Amazon-web-services
  3. Aws S3 Cp Returns An Error Occurred 403 When Calling The Headobject Operation Forbidden

Clienterror: an error occurred (403) when calling the headobject operation: forbidden
Clienterror: an error occurred (403) when calling the headobject operation: forbidden
Clienterror: an error occurred (403) when calling the headobject operation: forbidden
Clienterror: an error occurred (403) when calling the headobject operation: forbidden
Clienterror: an error occurred (403) when calling the headobject operation: forbidden
Clienterror: an error occurred (403) when calling the headobject operation: forbidden
Clienterror: an error occurred (403) when calling the headobject operation: forbidden
Clienterror: an error occurred (403) when calling the headobject operation: forbidden

aws s3 cp returns An error occurred (403) when calling the HeadObject operation: Forbidden

Tags: amazon-web-services , amazon-s3 Answers: 1 | Viewed 13,806 times

Foreword

I guess it may be a duplication but other posts with the same problem didn't help me much.


A problem


aws s3 cp s3://s3-us-west-2.amazonaws.com/my-test-bucket/intro.jpg test.jpg

Outputs the following:

fatal error: An error occurred (403) when calling the HeadObject operation: Forbidden

Bucket Policy:


{
"Version": "2012-10-17",
"Id": "Policy1539624480514",
"Statement": [
{
"Sid": "Stmt1539624478431",
"Effect": "Allow",
"Principal": "*",
"Action": "s3:*",
"Resource": [
"arn:aws:s3:::my-test-bucket",
"arn:aws:s3:::my-test-bucket/*"
]
}
]
}

Some notes


  1. intro.jpg was added by user A (who has AdministratorAccess) via AWS Console Dashboard (it's not copy file between buckets)

  2. aws sts get-caller-identity returns me information about user A

    {
    "UserId": "AIDXXXX3KDQHYYYYXRLO",
    "Account": "765123991235",
    "Arn": "arn:aws:iam::765123991235:user/[email protected]"
    }

  3. cat ~/.aws/config



[default]
region = us-west-2
output = json

  1. cat ~/.aws/credentials points to user A access key and secret


[default]
aws_access_key_id = AZZZIXXXXJQZA6YYYYUQ
aws_secret_access_key = <<<<<<<<<KEY REMOVED>>>>>>>>

  1. aws s3 ls returns the correct list of buckets

  2. time is synced on my local machine correctly



Michael - sqlbot answer at 2018-10-16 8


s3://s3-us-west-2.amazonaws.com/my-test-bucket/intro.jpg refers to a bucket named s3-us-west-2.amazonaws.com and the object key my-test-bucket/intro.jpg.

Access is denied because that isn't your bucket.

The correct URI here would be s3://my-test-bucket/intro.jpg.


* The answers/resolutions are collected from stackoverflow, are licensed under CC BY-SA 4.0

Some Code Answers


{
"Version": "2012-10-17",
"Id": "Policy1539624480514",
"Statement": [
{ "Sid": "Stmt1539624478431", "Effect": "Allow", "Principal": "*", "Action": "s3:*", "Resource": [
"arn:aws:s3:::my-test-bucket",
"arn:aws:s3:::my-test-bucket/*" ]
}
] }

{
"UserId": "AIDXXXX3KDQHYYYYXRLO",
"Account": "765123991235",
"Arn": "arn:aws:iam::765123991235:user/[email protected]" }[default] region = us-west-2 output = json[default] aws_access_key_id = AZZZIXXXXJQZA6YYYYUQ aws_secret_access_key = <<<<<<<<<KEY REMOVED>>>>>>>>

Troubleshoot 403 Access Denied errors from Amazon S3

1 week ago Jul 28, 2022  · 1. Run the list-buckets AWS Command Line Interface (AWS CLI) command to get the Amazon S3 canonical ID for your account by querying the Owner ID. aws s3api list-buckets --query "Owner.ID". 2. Run the list-objects command to get the Amazon S3 canonical ID of the account that owns the object that users can't access.

Show details

See also: List Api

fatal error: An error occurred (403) when calling the HeadObject ...

3 days ago Jul 01, 2022  · There are two sides to S3 permissions. One is the permission to take S3 actions at all which is defined in the IAM Permissions for the user, a group the user is …

Author: Teri Radichel

Show details

AWS CLI S3 A client error (403) occurred when calling the …

1 week ago Jun 15, 2021  · Learn & Grow with Popular eLearning Community - JanBask Training

Show details

Troubleshoot the 403 Forbidden error when uploading

2 days ago Apr 27, 2022  · Follow these steps: Open the Amazon S3 console. From the list of buckets, open the bucket you want to upload files to. Choose the Permissions tab. Choose Bucket policy. Search for statements with "Effect": "Deny". Verify that your bucket policy includes the correct URI request parameters for s3:PutObject to meet the specific conditions.

Show details

See also: List File

An error occurred (403) when calling the HeadObject operation

2 days ago Nov 29, 2018  · The text was updated successfully, but these errors were encountered:

Show details

See also: Date

AWS S3 403 Forbidden Error - How to troubleshoot - Bobcares

3 days ago Jun 03, 2021  · The upload should meet the bucket policy requirements for access to the s3:PutObject action. For example, suppose the bucket policy explicitly denies s3:PutObject.Unless the request includes server-side encryption using AWS KMS or Amazon S3 encryption keys, we need to verify we use the correct encryption header to upload objects.

Show details

Error Responses - Amazon Simple Storage Service

1 week ago This account is not authorized to add AWS Organizations. 403 Forbidden: Not supported: OrgConfigurationNotSupported: The specified Region does not support AWS Organizations in the configuration. 403 Forbidden: Not supported: ServiceNotEnabledForOrg: The S3 Storage Lens service-linked role is not enabled for the organization. 403 Forbidden: Not ...

Show details

HeadObject - Amazon Simple Storage Service

1 week ago Dec 21, 2012  · If an archive copy is already restored, the header value indicates when Amazon S3 is scheduled to delete the object copy. For example: x-amz-restore: ongoing-request="false", expiry-date="Fri, 21 Dec 2012 00:00:00 GMT". If the object restoration is in progress, the header returns the value ongoing-request="true".

Show details

See also: Rest Date

AWS CLI S3 Произошла ошибка клиента (403) при вызове …

1 week ago Mar 22, 2016  · Я пытаюсь настроить Amazon Linux AMI(ami-f0091d91) и имею сценарий, который запускает команду копирования для копирования из корзины S3. aws - …

Show details

Please leave your answer here: