Help Center/ Object Storage Service/ FAQs/ Access Control/ Why Can't I Access OBS (403 AccessDenied) After Being Granted with the OBS Access Permission?
Updated on 2024-10-15 GMT+08:00
View PDF
Share

Why Can't I Access OBS (403 AccessDenied) After Being Granted with the OBS Access Permission?

Problem Description

By configuring IAM permissions, bucket policies, or bucket ACLs, you have been granted the permissions needed to access OBS. However, when you try to access OBS, the error message Access denied or 403 AccessDenied is displayed.

Problem Analysis

Possible causes are described here in order of how likely they are to occur. To locate the root cause as fast as possible, go through the list in order, from most likely to least.

If the fault persists after a possible cause is rectified, move down the list to the next most likely cause.

OBS provides multiple ways to control permissions. To better understand how permissions management works, read Introduction to OBS Permissions Management. For details about how to configure permissions for different scenarios, see Typical Permissions Management Scenarios.

Figure 1 Analysis process
Table 1 Problem Analysis

Possible Cause

Solution

The permissions did not take effect due to IAM caching.

Due to data caching, it can take about 10 to 15 minutes for a new IAM permission configuration to take effect. Try again in 10 to 15 minutes.

An incorrect account or access key (AK or SK) was used to access OBS.

If you do not have the permissions needed to access OBS, the login information, such as the account or AK/SK used was likely incorrect. Incorrect use of AK/SK is more common. For example, you may be using an AK/SK or password for a different account.

Confirm the login credentials with the resource owner.

The permissions were incorrectly configured.

For details, see Checking Whether Permissions Are Correctly Configured.

The permissions were configured as denied.

For details, see Checking Whether a Permission Is Configured as Denied.

URL validation was configured.

Modify the Referer field in the whitelist or blacklist by referring to Configuring URL Validation.

The account balance was insufficient.

Top up your account and try again. For details, see Topping Up an Account.

Checking Whether Permissions Are Correctly Configured

OBS provides multiple mechanisms for permissions management, and in some scenarios there may be dependencies involved. If you cannot access OBS, contact the person who assigned the permissions (usually the resource owner) to check whether the permissions were configured correctly. There are two critical elements to check: Resources (what resources are authorized) and Actions (what operations are authorized). For common known mistakes, see Table 2. If Condition is configured in the IAM permission or bucket policy, check whether the specified rules are met.

Table 2 Commonly seen mistakes in configuring Resources and Actions

Type

Common Mistake

Resources
  • You were granted access to a given bucket but tried to access a different bucket.
  • You were granted access to a bucket but not to the objects in that bucket.
  • You were granted access to view a bucket but not to perform any operations (for example, listing objects in the bucket).
  • You were only granted access to certain objects in a bucket but tried to access other objects.

Actions

Checking IAM permissions

  1. Use the resource owner's account to log in to Huawei Cloud and click Console in the upper right corner.
  2. On the management console, hover over the username in the upper right corner, and choose Identity and Access Management from the drop-down list.
  3. On the Users page, search for the name of the user that could not access OBS. Click the name to check which user group the user belongs to.
  4. On the User Groups page, search for the user group to which the user belongs. In the Operation column of the user group, click Manage Permissions to see which IAM permissions have been granted.

Checking the bucket policy

  1. Use the resource owner's account to log in to Huawei Cloud and click Console in the upper right corner.
  2. In the service list, choose Storage > Object Storage Service.
  3. In the bucket list, search for the bucket that fails to be accessed and click the bucket name. The Objects page is displayed.
  4. In the navigation pane, choose Permissions > Bucket Policies to view the configured bucket policies.

Checking the bucket ACL

  1. Use the resource owner's account to log in to Huawei Cloud and click Console in the upper right corner.
  2. In the service list, choose Storage > Object Storage Service.
  3. In the bucket list, search for the bucket that fails to be accessed and click the bucket name. The Objects page is displayed.
  4. In the navigation pane, click Permissions. The Bucket Policies tab page is displayed. Then go to the Bucket ACLs page to view the configured bucket ACLs.

Checking the object ACL

  1. Use the resource owner's account to log in to Huawei Cloud and click Console in the upper right corner.
  2. In the service list, choose Storage > Object Storage Service.
  3. In the bucket list, search for the bucket that fails to be accessed and click the bucket name. The Objects page is displayed.
  4. In the object list, search for the object that fails to be accessed and click the object name. On the page that is displayed, view the object ACL configuration on the Object ACL tab.

Checking Whether a Permission Is Configured as Denied

If the required permissions are correctly configured but OBS still cannot be accessed, the possible cause is that the permission effect is configured as denied.

Based on the principle of least-privilege, decisions default to deny, and an explicit deny statement always takes precedence over an allow statement. If there are multiple IAM permissions or bucket policies, as long as there is an explicit deny statement, it will take precedence over allow statements, even the denied permissions are allowed in other bucket policies.

Both IAM permissions and bucket policies can include deny statements, so you need to check these configurations separately.

Checking IAM permissions

  1. Use the resource owner's account to log in to Huawei Cloud and click Console in the upper right corner.
  2. On the management console, hover over the username in the upper right corner, and choose Identity and Access Management from the drop-down list.
  3. On the Users page, search for the name of the user that could not access OBS. Click the name to check which user group the user belongs to.
  4. On the User Groups page, search for the user group to which the user belongs. In the Operation column of the user group, click Manage Permissions to see which IAM permissions have been granted.

Checking the bucket policy

  1. Use the resource owner's account to log in to Huawei Cloud and click Console in the upper right corner.
  2. In the service list, choose Storage > Object Storage Service.
  3. In the bucket list, search for the bucket that fails to be accessed and click the bucket name. The Objects page is displayed.
  4. In the navigation pane, choose Permissions > Bucket Policies to view the configured bucket policies.

Submitting a Service Ticket

If the problem persists, submit a service ticket to contact Huawei Cloud customer service for assistance.

Parent topic: Access Control