Problem description
OSS returns a 403 error when the requester lacks read permissions on the target object or provides invalid credentials.
Causes
| Cause | Details |
|---|---|
| Invalid credentials | The AccessKey ID or AccessKey secret is incorrect or invalid. |
| Missing permissions | The identity (RAM user, Security Token Service (STS) temporary credentials, or anonymous) does not have read access to the object. |
| Block Public Access interference | Block Public Access is enabled on the bucket, overriding the bucket or object ACL even when the ACL is set to public-read or public-read-write. |
Examples
The error occurs when an anonymous user accesses a private object, or when an account accesses a private object in a bucket it does not own.
The error also occurs when Block Public Access is enabled for the bucket, even if the bucket or object ACL is set to public-read or public-read-write.
Solutions
Work through the following checks in order until the error is resolved.
Verify your credentials
Make sure the AccessKey ID and AccessKey secret are valid. An incorrect or invalid AccessKey causes all requests to be denied, regardless of the permission configuration.
Check permissions for RAM users and STS credentials
If you use a RAM user or STS temporary credentials, confirm that the identity has a RAM policy that grants read access to the target object.
For guidance, see:
Check Block Public Access settings
If the bucket or object ACL is set to public-read but requests are still rejected, Block Public Access may be overriding the ACL. Check whether Block Public Access is enabled for the bucket and disable it if appropriate.
Block Public Access takes precedence over ACL settings. A request can be denied even when the ACL explicitly allows access.
Grant access with a signed URL
To share a private object with specific users without changing the bucket or object permissions, generate a signed URL. The signed URL grants time-limited access to the object without making it public. For more information, see Add signatures to URLs.
Set the bucket or object ACL to public-read (not recommended)
To allow all users, including anonymous users, to read an object, set the bucket or object ACL to public-read. To allow all users to read and write, set it to public-read-write.
Making a bucket or object publicly accessible exposes it to unauthorized access. Avoid this approach unless you have a specific requirement for public access.
For details, see Bucket ACL and Object ACL.