Why Can't I Access OBS (403 AccessDenied) After Being Granted with the OBS Access Permission?

Problem Description

By configuring IAM permissions, bucket policies, or bucket ACLs, you have been granted the permissions needed to access OBS. However, when you try to access OBS, the error message Access denied or 403 AccessDenied is displayed.

Problem Analysis

Possible causes are described here in order of how likely they are to occur. To locate the root cause as fast as possible, go through the list in order, from most likely to least.

If the fault persists after a possible cause is rectified, move down the list to the next most likely cause.

OBS provides multiple ways to control permissions. To better understand how permissions management works, read Introduction to OBS Permissions Management. For details about how to configure permissions for different scenarios, see Typical Permissions Management Scenarios.

Figure 1 Analysis process

Checking Whether Permissions Are Correctly Configured

OBS provides multiple mechanisms for permissions management, and in some scenarios there may be dependencies involved. If you cannot access OBS, contact the person who assigned the permissions (usually the resource owner) to check whether the permissions were configured correctly. There are two critical elements to check: Resources (which resources access is granted to) and Actions (authorized operations). For commonly seen mistakes, see Table 2. If Condition is configured in the IAM permission or bucket policy, check whether the specified rules are met.

Checking IAM permissions

1. Use the resource owner's account to log in to Huawei Cloud and click Console in the upper right corner.
2. On the management console, hover over the username in the upper right corner, and choose Identity and Access Management from the drop-down list.
3. On the Users page, search for the name of the user that could not access OBS. Click the name to check which user group the user belongs to.
4. On the User Groups page, search for the user group to which the user belongs. In the Operation column of the user group, click Manage Permissions to see which IAM permissions have been granted.

Checking the bucket policy

1. Use the resource owner's account to log in to Huawei Cloud and click Console in the upper right corner.
2. In the service list, choose Storage > Object Storage Service.
3. In the bucket list, search for the bucket that fails to be accessed and click the bucket name. The Objects page is displayed.
4. In the navigation pane, choose Permissions > Bucket Policies to view the configured bucket policies.

Checking the bucket ACL

1. Use the resource owner's account to log in to Huawei Cloud and click Console in the upper right corner.
2. In the service list, choose Storage > Object Storage Service.
3. In the bucket list, search for the bucket that fails to be accessed and click the bucket name. The Objects page is displayed.
4. In the navigation pane, click Permissions. The Bucket Policies tab page is displayed. Then go to the Bucket ACLs page to view the configured bucket ACLs.

Checking the object ACL

1. Use the resource owner's account to log in to Huawei Cloud and click Console in the upper right corner.
2. In the service list, choose Storage > Object Storage Service.
3. In the bucket list, search for the bucket that fails to be accessed and click the bucket name. The Objects page is displayed.
4. In the object list, search for the object that fails to be accessed and click the object name. On the page that is displayed, view the object ACL configuration on the Object ACL tab.

Checking Whether a Permission Is Configured as Denied

If the required permissions are correctly configured but OBS still cannot be accessed, the possible cause is that the permission effect is configured as denied.

Based on the principle of least-privilege, decisions default to deny, and an explicit deny statement always takes precedence over an allow statement. If there are multiple IAM permissions or bucket policies, as long as there is an explicit deny statement, it will take precedence over allow statements, even the denied permissions are allowed in other bucket policies.

Both IAM permissions and bucket policies can include deny statements, so you need to check these configurations separately.

Checking IAM permissions

1. Use the resource owner's account to log in to Huawei Cloud and click Console in the upper right corner.
2. On the management console, hover over the username in the upper right corner, and choose Identity and Access Management from the drop-down list.
3. On the Users page, search for the name of the user that could not access OBS. Click the name to check which user group the user belongs to.
4. On the User Groups page, search for the user group to which the user belongs. In the Operation column of the user group, click Manage Permissions to see which IAM permissions have been granted.

Checking the bucket policy

1. Use the resource owner's account to log in to Huawei Cloud and click Console in the upper right corner.
2. In the service list, choose Storage > Object Storage Service.
3. In the bucket list, search for the bucket that fails to be accessed and click the bucket name. The Objects page is displayed.
4. In the navigation pane, choose Permissions > Bucket Policies to view the configured bucket policies.

Submitting a Service Ticket

If the problem persists, submit a service ticket to contact Huawei Cloud customer service for assistance.