Skip to navigationSkip to main contentSkip to footerScaleway Docs HomepageAsk our AI
Ask our AI
Log inSign up

I cannot access my buckets or objects

Most access issues with Scaleway Object Storage come from one of the following sources: the API key, the IAM permissions of its bearer, or a bucket policy. Find the symptom that matches your situation in the following sections.

Before you start

To complete the following actions, you must have:

My API key does not work

When using third-party API or CLI tools, such as the AWS CLI, MinIO Client, or Rclone to manage your Object Storage resources, you experience one of the following issues:

  • Listing your buckets with a third-party tool returns nothing, but you have at least one bucket in the Scaleway console (External link).
  • The tool returns An error occurred (Forbidden) when calling the ListObjectsV2 operation: Forbidden or a similar message.
  • The tool returns a 403 error.

Cause

The API key you used to configure the third-party tool has a preferred Project assigned.

If you perform Object Storage operations in a Project that is not the preferred Project of the API key using a third-party tool, you cannot access your resources, and the tool returns an error message or an empty response.

Solution

  1. Make sure that you are using a valid API key (External link).
  2. Make sure that the bearer of the API key (IAM user or application) has the appropriate IAM permissions to perform the desired actions.
  3. Make sure that the preferred Project of the API key is the Project where you are performing actions. You can change the preferred Project of your API key:
  4. Make sure that no bucket policy prevents the action. If there is one, update the bucket policy to allow the desired actions to the bearer of the API key.

See the documentation on using IAM API keys with Object Storage for more information.

I get error messages when accessing a bucket

One of the following messages displays when an application tries to access your bucket:

  • Failed to preprocess target Error: S3 error: Access Denied
  • Error: Shared memory connection was closed.
  • Failed to upload disk 'shadowSpec>'
  • Agent failed to process method {DataTransfer.SyncDisk}.

Cause

The application cannot access the Object Storage resource.

Note

The Shared memory connection was closed. and Agent failed to process method {DataTransfer.SyncDisk}. messages can also indicate that your application reached the request rate limit. If the solution below does not solve the issue, refer to the request rate errors troubleshooting.

Solution

  1. Check for issues with your API key by following the API key troubleshooting procedure.
  2. Make sure that you have the ObjectStorageFullAccess IAM permission set.
  3. Make sure that no bucket policy prevents the application from accessing your bucket.

I lost access to a bucket after applying a bucket policy

After creating and applying a bucket policy to a bucket, you can no longer access the resources within the bucket, and one of the following messages displays:

  • [CLI] - An error occurred (AccessDenied) when calling the ListObjectsV2 operation: Access Denied
  • [CLI] - 403 AccessDenied
  • [Console] - Failed to update bucket. Retry.
  • [Console] - Failed to load data. Try refreshing the page.

Cause

Bucket policies automatically deny actions to users who are not explicitly allowed by a statement. If the bucket policy does not explicitly allow you, you lose access to the resources in the bucket.

Important
  • You will lose access to your bucket if you are not the owner of the Organization, and if you are not explicitly allowed by the bucket policy.
  • The owner of the Organization always has the right to put and delete bucket policies, even if he is not allowed to perform other bucket operations by the bucket policy.
  • Each bucket can have only one bucket policy.
  • Pushing a new bucket policy to a bucket overwrites any existing bucket policy.

Solution

If you have permission to apply a bucket policy, you can edit or delete the bucket policy to regain access.

See the bucket policies overview for more information on the different elements of a bucket policy.

I get presigned URL errors

You receive an error when using a presigned URL to access an object.

Cause

  • A clock skew of more than 15 minutes between the host and the client triggers an InvalidSignatureException or a RequestTimeTooSkewed error.
  • The presigned URL of your private object has expired.

Solution

  • Make sure that the clock skew between the host and client machines is less than 15 minutes.
  • Make sure that the presigned URL has not expired. If it has, generate a new one.

See the documentation on sharing objects for more information on presigned URLs.

I cannot access my objects

You experience issues accessing your buckets and objects, and none of the symptoms mentioned previously match your situation.

Solution

Going further

  • Refer to the Amazon S3 and IAM permissions equivalence to find the IAM permission set required for each operation.
  • When you contact the Support team about Object Storage, include the endpoint (e.g., s3.fr-par.scw.cloud), the bucket name, and the object name if the request concerns an object.

If you still cannot solve your problem, open a support ticket, providing as many details as possible including the information below:

  • Resource ID
  • Resource name
  • Date and time (timestamp)
  • User-agent (SDK, client, console, etc.)
  • Transaction ID (if possible)
  • Log / trace of the error (if possible)
  • Screenshots (using our secure pastebin tool (External link))
  • HTTP status code (if applicable)
  • Request type (PUT, GET, etc., if applicable)

AI search

Use our AI assistant to find solutions.

Ask AI

FAQ

Get general information on Scaleway products.

Read FAQ
Still need help?

Create a support ticket
No Results