Help Center/ Object Storage Service/ API Reference/ Error Codes/ 403/ AccessDenied
Updated on 2026-07-27 GMT+08:00
View PDF
Share

AccessDenied

AccessDenied

Error Description

No permissions.

Error Cause

Insufficient permissions are usually related to the IAM policy, bucket policy, ACL, or other policy you have configured. Common causes are listed as follows:

  • Cause 1: The IAM policy, bucket policy, or ACL is incorrectly configured.
  • Cause 2: Only one of the policies among the IAM policy, bucket policy, and ACL is configured for cross-account access.
  • Cause 3: Access is denied by the configured IAM policy, bucket policy, VPC Endpoint policy, or belonging organization's SCP.
  • Cause 4: An URL validation blacklist is configured to deny access.
  • Cause 5: BPA is enabled for the bucket, and the bucket policy or object ACL contains public access policies.
  • Cause 6: The policy does not take effect due to IAM caching. Due to data caching, it takes about 10 to 15 minutes for a new IAM policy to take effect. Wait for 10 to 15 minutes and try again.

Handling Suggestion

Step 1: Identify the Scenario (Same-Account or Cross-Account)

First, determine whether the situation involves the same account or different accounts.

(Optional) Step 2: Handle the Fault in the Same-Account Scenario (Choose Either This or the Cross-Account Scenario)

In the same-account scenario, authorization can be managed using either IAM (recommended) or bucket policies. Perform the following steps to locate and rectify the fault:

  1. Check whether the authorization is correct.

    1. Refer to Permissions and Supported Actions to obtain the actions required for the desired operation. For example, the action required for deleting an object is obs:object:deleteObject.
    2. If IAM authorization is used (recommended), check the IAM policy to see if the user has the required actions. If required actions are not authorized, contact the account administrator (user Admin) to grant authorization by referring to Using IAM Roles or Policies to Grant Access to OBS or Using IAM Identity Policies to Grant Access to OBS (New IAM Console).
    3. If bucket policy-based authorization is used, check the bucket policy to see if the user has the required actions. If required actions are not authorized, contact the bucket owner (the IAM user who created the bucket) or account administrator to grant authorization by referring to Creating a Custom Bucket Policy (Visual Editor).

  2. Check for the Deny configuration.

    SN

    Check Item

    Check Method

    Handling Measure

    1

    IAM policy

    Check the IAM policy to see if the actions obtained in 1 are set to Deny.

    Contact the account administrator (user Admin) to change Deny to Allow.

    2

    Bucket policy

    Check the bucket policy to see if the actions obtained in 1 are set to Deny.

    Contact the bucket owner (the IAM user who created the bucket) or account administrator to change Deny to Allow.

    3

    VPC Endpoint policy

    Check the VPC Endpoint policy to see if the actions obtained in 1 are set to Deny.

    Contact the account administrator (user Admin) or the endpoint creator to change Deny to Allow.

    4

    Service control policy (SCP)

    Check the SCP of your organization to see if the actions obtained in 1 are set to Deny.

    Contact the organization administrator (management account of the organization or an IAM user with SCP permissions under the management account) to change Deny to Allow.

  3. Check whether the URL has been added to a URL validation blacklist.

    Check whether the website that sends the access request to the bucket is added to a URL validation blacklist by referring to Configuring URL Validation. If the website is in the blacklist, contact the bucket owner (the IAM user who created the bucket) or account administrator to remove it.

  4. Check whether the access is made through Console/OBS Browser+ or API/SDK/obsutil.

    To access buckets and objects through Console or OBS Browser+, the ListAllMyBuckets and ListBucket permissions need to be granted explicitly. Contact the account administrator (user Admin) to grant the permissions by referring to Using IAM Roles or Policies to Grant Access to OBS or Using IAM Identity Policies to Grant Access to OBS (New IAM Console).

(Optional) Step 3: Handle the Fault in the Cross-Account Scenario (Choose Either This or the Same-Account Scenario)

In the cross-account scenario, authorization must be managed using IAM and bucket policies (recommended) or IAM and ACLs. For example, if account A needs to access a bucket of account B, the following operations are required:

  • The administrator of account A uses an IAM policy to grant authorization to IAM users in account A.
  • The bucket owner (the IAM user who created the bucket) of account B uses a bucket policy or an ACL to grant authorization to IAM users in account A.

Account A (the requester who accesses the bucket or object) performs the following steps to locate and handle the fault:

  1. Check whether the authorization is correct.

    1. Refer to Permissions and Supported Actions to obtain the actions required for the desired operation. For example, the action required for deleting an object is obs:object:deleteObject.
    2. Use IAM authorization and check the IAM policy to see if the user has the required actions. If required actions are not authorized, contact the account administrator (user Admin) to grant authorization by referring to Using IAM Roles or Policies to Grant Access to OBS or Using IAM Identity Policies to Grant Access to OBS (New IAM Console).

  2. Check for the Deny configuration.

    SN

    Check Item

    Check Method

    Handling Measure

    1

    IAM policy

    Check the IAM policy to see if the actions obtained in 1 are set to Deny.

    Contact the account administrator (user Admin) to change Deny to Allow.

    2

    VPC Endpoint policy

    Check the VPC Endpoint policy to see if the actions obtained in 1 are set to Deny.

    Contact the account administrator (user Admin) or the endpoint creator to change Deny to Allow.

    3

    Service control policy (SCP)

    Check the SCP of your organization to see if the actions obtained in 1 are set to Deny.

    Contact the organization administrator (management account of the organization or an IAM user with SCP permissions under the management account) to change Deny to Allow.

  3. Check whether the access is made through OBS Browser+ or API/SDK/obsutil. Cross-account access through Console is currently not supported.

    To access bucket objects through OBS Browser+, the ListBucket permission needs to be granted explicitly. Contact the account administrator (user Admin) grant the permission by referring to Using IAM Roles or Policies to Grant Access to OBS or Using IAM Identity Policies to Grant Access to OBS (New IAM Console).

Account B (the account that owns the bucket or object) performs the following steps to locate and rectify the fault:

  1. Check whether the authorization is correct.

    1. Refer to Permissions and Supported Actions to obtain the actions required for the desired operation. For example, the action required for deleting an object is obs:object:deleteObject.
    2. If bucket policy-based authorization is used (recommended), check the bucket policy to see if the user has the required actions. If required actions are not authorized, contact the bucket owner (IAM user who created the bucket) to grant authorization using a bucket policy.
    3. If ACL-based authorization is used, check the ACL to see if the user has the required actions. If required actions are not authorized, contact the bucket owner (the IAM user who created the bucket) to grant authorization using a bucket ACL.

  2. Check for the Deny configuration.

    Check Item

    Check Method

    Handling Measure

    Bucket policy

    Check the bucket policy to see if the actions obtained in 1 are set to Deny.

    Contact the bucket owner (the IAM user who created the bucket) to change Deny to Allow.

  3. Check whether the URL has been added to a URL validation blacklist.

    Check whether the website that sends the access request to the bucket is added to a URL validation blacklist by referring to Configuring URL Validation. If the website is in the blacklist, contact the bucket owner (the IAM user who created the bucket) to remove it.

  4. Check whether the access is made through OBS Browser+ or API/SDK/obsutil. Cross-account bucket access through Console is currently not supported.

    To access objects in a bucket using OBS Browser+, the ListBucket permission needs to be granted explicitly. Contact the bucket owner (the IAM user who created the bucket) to grant the permission by using a bucket policy.

Step 4: Check Whether the Permission Configuration Meets the BPA Requirements

If the error is reported when you are modifying the ACL of an existing object in a bucket, perform the following steps to locate and rectify the fault:

  1. Check the BPA configuration to see if BlockPublicAcls is enabled. If it is enabled, go to 2. If it is disabled, go to Step 5: Wait for Cache Update.

    You can call the Obtaining the BPA Configuration of a Bucket API to check whether BlockPublicAcls is enabled. Alternatively, you can log in to OBS Console, click the bucket name to go to the bucket details page, choose Permissions > Block Public Access, and check whether BlockPublicAcls is enabled.

  2. Modify the object ACL to block public access.

If the error is reported during an operation other than object ACL modification, perform the following steps to locate and rectify the fault:

  1. Check the BPA configuration to see if RestrictPublicBuckets is enabled. If it is enabled, go to 2. If it is disabled, go to Step 5: Wait for Cache Update.

    You can call the Obtaining the BPA Configuration of a Bucket API to check whether RestrictPublicBuckets is enabled. Alternatively, you can log in to OBS Console, click the bucket name to go to the bucket details page, choose Permissions > Block Public Access, and check whether RestrictPublicBuckets is enabled.

  2. Check whether any bucket policy allows public access. For details, see Block Public Access. If there is such a policy, go to 3. If there is not, go to Step 5: Wait for Cache Update.
  3. Delete the bucket policy that allows public access.

Step 5: Wait for Cache Update

If access continues to fail after completing the previous steps, the likely cause is that the cache has not refreshed. Wait 10 to 15 minutes and then try again.

Precautions

  • With GetObject, the returned error code is affected by the object status and permission configuration.
    • If the object exists, the system checks whether the user has the GetObject permission. If the user has the permission, the object can be accessed. If the user does not have the permission, error code 403 is returned.
    • If the object does not exist, the conditions are as follows:

      With GetObject (Object Download) Permission

      With ListBucket (Bucket Object Listing) Permission

      Returned Error Code

      Yes

      Yes

      404

      Yes

      No

      403

      No

      Yes

      403
  • If the bucket and object belong to different accounts, for example, account A uploads an object to a bucket of account B, the object belongs to account A, and the bucket belongs to account B.

AccessDenied. User: <user> is not authorized to perform: <action>on resource: <resource> because no <policy_type> policy allows the <action_type> action.

Error description

This access request is not explicitly authorized.

Error cause

User <user> does not have the permission to operate resource <resource> because the <policy_type> policy does not explicitly allow the <action> action.

Parameter

Description

user

Definition

The IAM user who fails the authentication. The access request initiated by this IAM user is denied due to the authentication failure.

The formats are as follows. <domainid> indicates the Huawei account ID, <userid> indicates the IAM user ID, <agency-name> indicates the agency name, <session-name> indicates the session name, and <idp-id> indicates the identity provider ID.

  • IAM user: iam::<domainid>:user:<userid>
  • IAM agency or trust session: sts::<domainid>:assumed-agency:<agency-name>/<session-name>
  • Virtual federated user: sts::<domainid>:external-user:<idp-id>/<session-name>

Range

N/A

resource

Definition

The resource URN. The resource access request is denied due to the authentication failure.

Range

  • When a bucket is accessed, the format is as follows: obs:::bucket:<BucketName>
  • When an object is accessed, the format is as follows: obs:::object:<BucketName>/<ObjectName>

<BucketName> indicates the accessed bucket name, and <ObjectName> indicates the accessed object name.

policy_type

Definition

The policy type. The authentication fails because this policy type does not explicitly grant the required permissions.

Range

  • identity-based: IAM policies
  • resource-based: resource policies, including bucket policies and ACLs
  • session: VPC Endpoint policies
  • service control: SCPs

action

Definition

The action that corresponds to a specific operation. The authorization fails because the action is not authorized.

Range

For details, see Permissions and Supported Actions. Each action corresponds to a bucket or an object operation.

Handling suggestion

Use the policy (specified by <policy_type>) returned in the response to grant the user (specified by <user>) the required permission (specified by <action>) to access the specific resource (specified by <resource>).

Example

An IAM user (whose ID is user001) attempts to upload an object (named obj1) to a bucket (named bucket01). The access is denied and error 403 is returned because the user is not explicitly authorized.

The response is as follows:

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
 
HTTP/1.1 403 Forbidden
Server: OBS
Content-Type: application/xml
Content-Length: 2893
Date: date

<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<Error>
  <Code>AccessDenied</Code>
  <Message>Access Denied. User: iam::domainid001:user:user001 is not authorized to perform: obs:object:putobject on resource: obs:::object:bucket01%2Fobj1 because no resource-based policy allows the obs:object:putobject action.</Message>
  <RequestId>0000019C41B3EA7C530608451D1F0447</RequestId>
  <HostId>Z9v+cC1sRnaWw6x0vi8pxxYA0YVnKxbYHUPAFpnxkX8sLV44u5b02Z+ailn2wCnR</HostId>
</Error>

As shown in the response, user user001 in account domainid001 does not have the permission to upload resource bucket01/obj1 because no resource policy (bucket policy or ACL) authorizes this operation.

Solution

The owner of bucket01 adds a bucket policy to explicitly grant user001 the putObject permission. 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
 
{
    "Statement": [
        {
            "Sid": "allow_put",
            "Action": [
                "PutObject"
            ],
            "Effect": "Allow",
            "Resource": "bucket01/*",
            "Principal": {
                "ID": [
                    "domain/domainid001:user/user001"
                ]
            }
        }
    ]
}

AccessDenied. User: <user> is not authorized to perform: <action> on resource: <resource> with an explicit deny in a/an/the <policy_type> policy.

Error description

This access request is explicitly denied.

Error cause

User <user> does not have the permission to operate resource <resource> because the <policy_type> policy explicitly denies the <action> action.

Parameter

Description

user

Definition

The IAM user who fails the authentication. The access request initiated by this IAM user is denied due to the authentication failure.

The format is as follows: iam::<domainid>:user/<userid>. <domainid> indicates the Huawei account ID and <userid> indicates the IAM user ID.

Range

N/A

resource

Definition

The resource URN. The resource access request is denied due to the authentication failure.

Range

When a bucket is accessed, the format is as follows: obs:::bucket:<BucketName>

When an object is accessed, the format is as follows: obs:::object:<BucketName>/<ObjectName>

<BucketName> indicates the accessed bucket name, and <ObjectName> indicates the accessed object name.

policy_type

Definition

The policy type. The authentication fails because this policy type does not explicitly grant the required permissions.

Range

  • identity-based: IAM policies
  • resource-based: resource policies. In an explicit deny scenario, resource policies can only be bucket policies. ACLs are not included.
  • session: VPC Endpoint policies
  • service control: SCPs

action

Definition

The action that corresponds to a specific operation. The authorization fails because the action is not authorized.

Range

For details, see Permissions and Supported Actions. Each action corresponds to a bucket or an object operation.

Handling suggestion

Check whether the policy (specified by <policy_type>) in the response denies the user (specified by <user>) the permission (specified by <action>) to perform an operation on the specific resource (specified by <resource>). If the policy exists and does not meet service requirements, change Deny to Allow after evaluation.

Example

An IAM user (whose ID is user001) attempts to download an object (named obj1) from a bucket (named bucket01). The access is denied and error 403 is returned because the bucket policy denies the operation.

The response is as follows:

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
 
HTTP/1.1 403 Forbidden
Server: OBS
Content-Type: application/xml
Content-Length: 2893
Date: date

<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<Error>
  <Code>AccessDenied</Code>
  <Message>Access Denied. User: iam::domainid001:user:user001 is not authorized to perform: obs:object:putobject on resource: obs:::object:bucket01%2Fobj1 with an explicit deny in a resource-based policy.</Message>
  <RequestId>0000019C41C77CB55306084530520492</RequestId>
  <HostId>Z9v+cC1sRnaWw6x0vi8pxxYA0YVnKxbYHUPAFpnxkX8sLV44u5b02Z+ailn2wCnR</HostId>
</Error>

As shown in the response, user user001 in account domainid001 does not have the permission to download resource bucket01/obj1 because the bucket policy explicitly denies this operation.

Solution

The owner of bucket01 modifies the bucket policy and changes the GetObject permission for user001 from Deny to Allow.

The owner of bucket01 modifies the bucket policy and removes the explicit deny setting from the policy. An example is provided as follows: 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
 
{
    "Statement": [
        {
            "Sid": "deny_put",
            "Action": [
                "GetObject"
            ],
            "Effect": "Allow",
            "Resource": "bucket01/obj1",
            "Principal": {
                "ID": [
                    "domain/domainid001:user/user001"
                ]
            }
        }
    ]
}

Invalid according to Policy: Policy Condition failed.

Error description

The policy in the POST request is not met.

Error cause

Condition verification with the security policy in the POST request form fails.

Handling suggestion

Check whether the content specified in the conditions field of the policy in the POST request form is consistent with that included in the request. For more information about security policies in forms, see Conditions.

Invalid according to Policy: Policy expired.

Error description

The policy in the POST request has expired.

Error cause

The security policy in the POST request form has expired.

Handling suggestion

Check whether the expiration field in the policy of the POST request form is incorrect.

Anonymous access is forbidden for this operation.

Error description

Anonymous access is forbidden for this operation.

Error cause

Anonymous users cannot perform this operation. For example, anonymous users cannot list buckets.

Handling suggestion

Perform the operation as a non-anonymous user. Specifically, include user identity information in the request. For details, see Authentication Overview.

custom domain name can not be visit directly, please use custom domain name.

Error description

The current domain name cannot be accessed directly.

Error cause

The domain name in use is not available. (It is a non-custom blocked domain name.)

Handling suggestion

Use a custom domain name or another domain name for access.

OBS authentication requires a valid Date or x-obs-date header

Error description

Access denied. The request does not include the date header or the header format is incorrect.

Error cause

A date related header (Date or x-obs-date) needs to be included in the API request. If not, error 403 is returned.

Handling suggestion

Include a correct date header. Examples are provided as follows:

  • Include the Date header: 
    PUT / HTTP/1.1
User-Agent: curl/7.29.0
Host: examplebucket.obs.cn-north-4.myhuaweicloud.com
Accept: */*
Date: Wed, 02 Apr 2025 09:54:15 GMT
Authorization: OBS H4IPJX0TQTHTHEBQQCEC:75/Y4Ng1izvzc1nTGxpMXTE6ynw=
Content-Length: 157
<CreateBucketConfiguration xmlns="http://obs.cn-north-4.myhuaweicloud.com/doc/2015-06-30/"> 
    <Location>cn-north-4</Location>
</CreateBucketConfiguration>
  • Include the x-obs-date header: 
    PUT / HTTP/1.1
User-Agent: curl/7.29.0
Host: examplebucket.obs.cn-north-4.myhuaweicloud.com
Accept: */*
x-obs-date: Wed, 02 Apr 2025 09:54:15 GMT
Authorization: OBS H4IPJX0TQTHTHEBQQCEC:75/Y4Ng1izvzc1nTGxpMXTE6ynw=
Content-Length: 157
<CreateBucketConfiguration xmlns="http://obs.cn-north-4.myhuaweicloud.com/doc/2015-06-30/"> 
    <Location>cn-north-4</Location>
</CreateBucketConfiguration>

The following table describes the parameters.

Header

Type

Mandatory

Description

Date

String

Mandatory if x-obs-date is not included

Definition

The date and time when a request was initiated, for example, Wed, 02 Apr 2025 09:54:15 GMT.

Constraints

This header is optional for anonymous requests or requests whose headers contain the x-obs-date header and mandatory for other requests. If both this header and x-obs-date are included, x-obs-date takes precedence.

Range

N/A

Default Value

N/A

x-obs-date

String

Mandatory if Date is not included

Definition

The date and time when a request was initiated, for example, Wed, 02 Apr 2025 09:54:15 GMT.

Constraints

This header is optional for anonymous requests or requests whose headers contain the Date header and mandatory for other requests. If both this header and Date are included, x-obs-date takes precedence.

Range

N/A

Default Value

N/A

The object you specified is immutable, can not delete

Error description

The object you specified is immutable and cannot be deleted.

Error cause

The object is protected by WORM and cannot be deleted before the retention period expires.

Handling suggestion

Delete the object after the WORM retention period expires.

Action PutBucketPolicy on bucket: <BucketName> is restricted because public policies are blocked by the BlockPublicPolicy block public access setting

Error description

Configuring a bucket policy (PutBucketPolicy) on the BucketName bucket is denied because the BlockPublicPolicy setting blocks bucket policies that allow public access.

Error cause

If the BlockPublicPolicy option in Block Public Access is enabled for a bucket, configuring a bucket policy that allows public access will be denied.

Handling suggestion

Modify the bucket policy to block public access.

Action PutBucketAcl on bucket: <BucketName> is restricted because public access control lists (ACLs) are blocked by the BlockPublicAcls block public access setting

Error description

Configuring a bucket ACL (PutBucketAcl) on the BucketName bucket is denied because the BlockPublicAcls setting blocks bucket ACLs that allow public access.

Error cause

If the BlockPublicAcls option in Block Public Access is enabled for a bucket, configuring a bucket ACL that allows public access will be denied.

Handling suggestion

Modify the bucket ACL to block public access.

Action PutObject on object: <BucketName/ObjectName> is restricted because public access control lists (ACLs) are blocked by the BlockPublicAcls block public access setting

Error description

Uploading the ObjectName object to the BucketName bucket is denied because the BlockPublicAcls setting blocks object ACLs that allow public access.

Error cause

If the BlockPublicAcls option in Block Public Access is enabled for a bucket, uploading an object with an ACL that allows public access will be denied.

Handling suggestion

Modify the object ACL to block public access.

Related Operations

Checking the IAM policy

  • Old Console:
    1. Log in to the IAM Old Console, search for the name of the user who fails to access OBS, and click the username to go to the user details page.
    2. View the Permissions tab of the user.
  • New Console:
    1. Log in to the IAM New Console, search for the name of the user who fails to access OBS, and click the username to go to the user details page.
    2. View the Permissions tab.

Checking the bucket policy

  1. In the bucket list, click the desired bucket. The Objects page is displayed.
  2. In the navigation pane, choose Permissions > Bucket Policies.

Checking the bucket ACL

  1. In the bucket list, click the desired bucket. The Objects page is displayed.
  2. In the navigation pane, choose Permissions > Bucket ACL.

Checking the object ACL

  1. In the bucket list, click the desired bucket. The Objects page is displayed.
  2. Check the configuration on the Object ACL page.

Checking the SCP

  1. Log in to the Organizations console as an organization administrator or using the management account.
  2. On the Policies page, click Service control policies.

Checking the VPC Endpoint policy: For details, see Managing the Policy of a VPC Endpoint.

Parent Topic: 403