If you receive an Access Denied or 403 Forbidden error when accessing Consumer Edge data in Amazon S3, the most common cause is missing permissions on the AWS IAM user or role in your own account.
Cross-account S3 access requires permissions to be configured on both sides:
Consumer Edge side: CE grants your IAM user or role ARN access to the applicable S3 bucket or access point.
Your side: The same IAM user or role must have an identity-based IAM policy that allows the required S3 actions against the CE resource.
AWS denies requests by default unless they are explicitly allowed. This means access can fail even when CE has already granted your ARN access on our side.
Common errors
You may see errors such as:
An error occurred (AccessDenied) when calling the ListObjectsV2 operation: Access Denied
An error occurred (403) when calling the HeadObject operation: Forbidden
AccessDenied: Access Denied
1. Confirm which AWS identity you are using
Before changing permissions, confirm that the AWS CLI or application is using the IAM identity you expect:
aws sts get-caller-identity
Compare the returned ARN with the IAM user or role ARN that was provided to Consumer Edge. If your workload is assuming a different role, permissions granted to another ARN will not apply.
2. Confirm IAM permissions in your AWS account
Consumer Edge grants the applicable S3 permissions on our side. Your IAM principal must separately allow the corresponding actions in your own AWS account.
For read-only access, the required permissions generally include:
s3:ListBuckets3:GetBucketLocations3:GetObjects3:GetObjectVersions3:GetObjectTagging
If your organization attaches the AWS-managed AmazonS3ReadOnlyAccess or AmazonS3FullAccess policy to the role, the required S3 permissions are typically already covered. If you use custom IAM policies, explicitly allow access to the CE resource.
Example policy for a CE S3 bucket
Use the following as a starting point when CE has provided a bucket name:
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": ["s3:ListBucket", "s3:GetBucketLocation"],
"Resource": "arn:aws:s3:::<bucket-name>"
},
{
"Effect": "Allow",
"Action": ["s3:GetObject", "s3:GetObjectVersion", "s3:GetObjectTagging"],
"Resource": "arn:aws:s3:::<bucket-name>/*"
}
]
}
Replace <bucket-name> with the bucket name provided by Consumer Edge.
Example policy for a CE S3 Access Point
If CE has provided an S3 Access Point ARN, your policy must reference both the access point and its object resource:
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": ["s3:ListBucket", "s3:GetBucketLocation"],
"Resource": "arn:aws:s3:<region>:<account-id>:accesspoint/<access-point-name>"
},
{
"Effect": "Allow",
"Action": ["s3:GetObject", "s3:GetObjectVersion", "s3:GetObjectTagging"],
"Resource": "arn:aws:s3:<region>:<account-id>:accesspoint/<access-point-name>/object/*"
}
]
}
Replace <region>, <account-id>, and <access-point-name> with the values provided by Consumer Edge.
3. Check for policies scoped to older CE resources
This is especially common when accessing a newly introduced CE bucket or access point.
If your IAM policy is scoped to specific S3 resource ARNs, access to an existing CE bucket does not automatically grant access to a new bucket or access point. Add the new ARN to your IAM policy and retest.
4. Test access directly
For bucket-based access, retry a simple list operation:
aws s3 ls s3://<bucket-name>/
If the request still returns AccessDenied, review any additional policy controls in your AWS environment, including permissions boundaries, session policies, or AWS Organizations Service Control Policies that may restrict the role.
Still receiving Access Denied?
Contact Consumer Edge Support and provide:
The IAM user or role ARN returned by
aws sts get-caller-identityThe CE bucket name or S3 Access Point ARN you are accessing
The exact error message
The date and time of the failed request, including timezone
With this information, we can quickly verify the permissions configured on the Consumer Edge side and help isolate where the request is being denied.
Additional resources
For more detail on AWS permissions and cross-account S3 access, see the following AWS documentation:
Cross-account policy evaluation logic - Explains how AWS evaluates permissions in both the resource-owning account and the accessing account.
Required permissions for Amazon S3 API operations - Maps common S3 operations to the IAM permissions they require.
Configuring IAM policies for using S3 Access Points - Covers identity and resource policies when accessing S3 through Access Points.
AWS CLI: get-caller-identity - Documents the command used to verify which AWS identity is making a request.