AWS.Tools.S3 Get-S3Bucket Access Denied

[dburtsev]

Describe the bug

Hello
I don't have permission to call the ListBuckets operation. I know my bucket name. I am using the access key and secret key.
From the same script, aws s3 ls 'bucket_name' works but [Amazon.S3.Model.S3Bucket]$ResponseS3 = Get-S3Bucket -BucketName 'bucket_name' does not.
Error: Access Denied
Thanks,
Dmitriy

Expected Behavior

Get Amazon.S3.Model.S3Bucket object from Get-S3Bucket

Current Behavior

Access Denied

Reproduction Steps

$Env:AWS_ACCESS_KEY_ID='qwe'
$Env:AWS_SECRET_ACCESS_KEY='xyz'
aws s3 ls 'bucket_name'
Amazon.S3.Model.S3Bucket]$ResponseS3 = Get-S3Bucket -BucketName 'bucket_name'

Possible Solution

No response

Additional Information/Context

No response

AWS Tools for PowerShell version used

Version 4.1.128

PowerShell version used

Name Value

---

PSVersion 7.2.5
PSEdition Core
GitCommitId 7.2.5
OS Microsoft Windows 10.0.19042
Platform Win32NT
PSCompatibleVersions {1.0, 2.0, 3.0, 4.0…}
PSRemotingProtocolVersion 2.3
SerializationVersion 1.1.0.1
WSManStackVersion 3.0

Operating System and version

Windows 10

[dburtsev]

Note: I have "Access Denied" only when I run this script from my PC using keys.
When I run this script without keys on EC2 instance with the attached role, I don't have any problems.
Thanks,
Dmitriy

[ashishdhingra]

@dburtsev You need to have the ListBuckets policy attached to your IAM user (having access keys and secret keys in above PowerShell snippet) in order to execute Get-S3Bucket CmdLet. On the EC2 instance it might have worked because the IAM role has this policy attached to it.

I'm unsure how aws s3 ls 'bucket_name' is working for you.

• Are you executing AWS CLI command from within PowerShell terminal?
• Do you have credentials configured in your default profile on your machine which has permissions to execute ListBuckets operation? May be AWS CLI is using the credentials from the default profile.

You may try using the Get-STSCallerIdentity CmdLet and AWS CLI aws sts get-caller-identity to see if there is any difference.

Thanks,
Ashish

[dburtsev]

Hello Ashish
I don't have the ListBuckets policy for this particular account.

Are you executing AWS CLI command from within PowerShell terminal?
I am executing AWS CLI command from PowerShell script

Do you have credentials configured in your default profile
No. In EC2 we use attached role and in my PC keys are hardcoded in the script.

[aws sts get-caller-identity]
{
"UserId": "AIDAZ7DNFLRF5WRSTAXOC",
"Account": "685276224587",
"Arn": "arn:aws:iam::685276224587:user/svc_mocsdw01AccessPA"
}
[Get-STSCallerIdentity]
Account Arn UserId

---

685276224587 arn:aws:iam::685276224587:user/svc_mocsdw01AccessPA AIDAZ7DNFLRF5WRSTAXOC

[ashishdhingra]

@dburtsev Unfortunately I'm unable to reproduce the issue. I get Access Denied error while using both AWS CLI aws s3 ls <<bucketname>> and PowerShell CmdLet Get-S3Bucket <<bucketname>>. Used the below 2 scenarios (after creating IAM user with programmatic access not having any permissions):

1. Configured the credentials in default profile at %USERPROFILE%\.aws\credentials.
2. Used the environment variable approach (as in your case) setting $Env:AWS_ACCESS_KEY_ID and $Env:AWS_SECRET_ACCESS_KEY.

In both the cases:

• AWS CLI returns error An error occurred (AccessDenied) when calling the ListObjectsV2 operation: Access Denied
• Get-S3Object CmdLet returns error Get-S3Bucket: Access Denied.

[dburtsev]

Configured the credentials in default profile at %USERPROFILE%.aws\credentials.

We don't have any credentials in %USERPROFILE%.aws
dir
Directory of %USERPROFILE%.aws

08/02/2022 03:28 PM

.
08/02/2022 03:28 PM ..
08/02/2022 03:28 PM 31 config
1 File(s) 31 bytes
2 Dir(s) 25,655,758,848 bytes free

%USERPROFILE%.aws>type config
[default]
region = us-east-1

[ashishdhingra]

Configured the credentials in default profile at %USERPROFILE%.aws\credentials.

We don't have any credentials in %USERPROFILE%.aws dir Directory of %USERPROFILE%.aws

08/02/2022 03:28 PM

.
08/02/2022 03:28 PM ..
08/02/2022 03:28 PM 31 config
1 File(s) 31 bytes
2 Dir(s) 25,655,758,848 bytes free
%USERPROFILE%.aws>type config [default] region = us-east-1

@dburtsev I tested using both scenarios, including environment variable approach (as in your case) setting $Env:AWS_ACCESS_KEY_ID and $Env:AWS_SECRET_ACCESS_KEY. Anyway, your account needs to have ListBuckets permission. I'm unsure on how your AWS CLI command works (you may try spinning up new EC2 without IAM role attached, installing PowerShell and AWS CLI, and try executing your scenario). In case you need assistance on why AWS CLI is working when the IAM account is not having permissions, please try opening an issue at https://github.com/aws/aws-cli. Unfortunately, we are unable to troubleshoot environment specific issues.

Thanks,
Ashish

[dburtsev]

I'm unsure on how your AWS CLI command works

It works correctly. If you know the bucket name, you don't need ListBuckets permission.
I test it with S3 Browser application from s3browser.com. It works without ListBuckets permission.
I test it with WinSCP application. It works without ListBuckets permission.

I expect that Get-S3Bucket command must work precisely the same as aws s3 ls
Thanks,
Dmitriy

[ashishdhingra]

I'm unsure on how your AWS CLI command works

It works correctly. If you know the bucket name, you don't need ListBuckets permission. I test it with S3 Browser application from s3browser.com. It works without ListBuckets permission. I test it with WinSCP application. It works without ListBuckets permission.

I expect that Get-S3Bucket command must work precisely the same as aws s3 ls Thanks, Dmitriy

@dburtsev If you refer GetS3BucketCmdlet, it calls the Amazon Simple Storage Service (S3) ListBuckets API operation. The ListBuckets returns a list of all buckets owned by the authenticated sender of the request. To use this operation, you must have the s3:ListAllMyBuckets permission.

[dburtsev]

If Get-S3Bucket command doesn't work precisely the same as aws s3 ls then we have a bug.

[ashishdhingra]

If Get-S3Bucket command doesn't work precisely the same as aws s3 ls then we have a bug.

@dburtsev We cannot use AWS CLI for comparison here since the Get-S3Object CmdLet is working as per the S3 service API specification where it is returning the error due to lack of permissions. The CmdLet simply invokes the ListBuckets service API operation and the error is returned by the S3 service. As mentioned earlier, you may try opening an issue at https://github.com/aws/aws-cli so that the AWS CLI team could help you troubleshoot the environmental issue on your machine with diagnostic tracing. You may try reproducing the issue on fresh EC2 instance (with no role attached) for reference.

[dburtsev]

AWS CLI is working. There is nothing to troubleshoot with AWS CLI team. S3 Browser and WinSCP also works. Boto3 python library works.
Only Get-S3Object doesn't.

[ashishdhingra]

aws s3 ls 'bucket_name'

@dburtsev Looks like you are mixing 2 commands. Those two commands are not the same thing.

• Get-S3Bucket CmdLet is only listing buckets alias with a filter of one bucket. It is invoking ListBuckets service API operation.
• Whereas the AWS CLI command aws s3 ls 'bucket_name' is listing objects in the bucket. It is invoking ListObjectsV2 service API operation (figured it out by using --debug flag). The corresponding PowerShell CmdLet for listing bucket objects is Get-S3Object, or better Get-S3ObjectV2.

[Cobra-James]

Thankyou... been pulling my hair out on this!

[dburtsev]

Thanks, It works now.

[github-actions[bot]]

Hello! Reopening this discussion to make it searchable.