0003-00000001
Problem description
Your account does not have permission to perform the requested operation on the bucket or object, or the credentials you provided are incorrect.
Causes
The AccessKey ID or AccessKey secret used to generate the request signature is incorrect.
The account authenticated in the request lacks the required permissions for the operation.
Examples
Incorrect credentials
A RAM user sends a request using an incorrect AccessKey ID or AccessKey secret, which produces an invalid signature.
Insufficient permissions: RAM user accessing a bucket
A RAM user sends a PutObject or GetObject request to a bucket, the RAM user lacks the required permissions, and the bucket Access Control List (ACL) is not set to public-read-write or public-read.
Insufficient permissions: CDN pulling from a private bucket
CDN is configured to pull content from a private OSS bucket, but the CDN origin is configured before the required permissions are granted. As a result, CDN cannot distribute the Security Token Service (STS) authentication configuration to its Points of Presence (POPs), causing access failures.
Insufficient permissions: ossbrowser 2.0 showing "The bucket you access does not belong to you"
A RAM user logs in to ossbrowser 2.0 using an AccessKey, but the RAM user lacks the oss:GetBucketInfo permission.
Insufficient permissions: Block Public Access overriding public ACL settings
A bucket or object ACL is set to public-read or public-read-write, but Block Public Access is enabled on the bucket. Requests are denied even when the ACL appears to allow access.
Solutions
Incorrect credentials
Verify that the AccessKey ID and the AccessKey secret used to generate the signature are correct.
Insufficient permissions: RAM user accessing a bucket
If you use a RAM user or temporary access credentials from STS, grant the account the required permissions. For details, see Use RAM policies to control access and Common examples of RAM policies.
Insufficient permissions: CDN pulling from a private bucket
Follow this order when configuring CDN to pull from a private bucket:
Grant the required OSS permissions to the RAM user.
Configure the private bucket as the CDN origin.
Insufficient permissions: ossbrowser 2.0 showing "The bucket you access does not belong to you"
Do one of the following:
Grant the RAM user the
oss:GetBucketInfopermission. For details, see Create custom policies and Grant permissions to a RAM user.Manually specify the region where the bucket is located when logging in, instead of relying on the preset path.
Insufficient permissions: Block Public Access overriding public ACL settings
To allow anonymous access, verify that Block Public Access is disabled for the bucket.