Jump toSuggest an edit

I lost access to a bucket after applying a bucket policy

Reviewed on 15 December 2023Published on 15 December 2023

Before you start

To complete the actions presented below, you must have:

  • Owner status or IAM permissions allowing you to perform actions in the intended Organization


When creating and applying a bucket policy to a bucket, you may lose access to the resources within the bucket if your bucket policy was not set properly.

Bucket policies automatically deny actions to users who are not explicitly allowed by a statement.

  • You will lose access to your bucket if you are not the owner of the Organization, and if you are not explicitly allowed by the bucket policy.
  • The owner of the Organization always has the right to put and delete bucket policies, even if he is not allowed to perform other bucket operations by the bucket policy.
  • Each bucket can have only one bucket policy.
  • Pushing a new bucket policy to a bucket overwrites any existing bucket policy.


If you are not explicitly allowed access to the resources in your bucket, you may see one of the following messages:

  • [CLI] - An error occurred (AccessDenied) when calling the ListObjectsV2 operation: Access Denied

  • [Console] - Failed to update bucket. Retry.

  • [Console] - Failed to load data. Try refreshing the page.


If you have the permission to apply a bucket policy, you can also delete it. To regain access to the resources stored in your bucket, you can either:

  • delete the current bucket policy using the command below. The bucket will become available to every users with IAM permissions.
    aws s3api delete-bucket-policy --bucket <BUCKET_NAME>
  • apply a new bucket policy in the bucket to allow yourself (or the desired principal) to perform the desired storage operations.

Going further

  • Refer to the bucket policies overview for more information on the different elements of a bucket policy.

  • If you did not manage to identify the error and solve it by yourself, open a support ticket, and provide as many details as possible, along with the necessary information below:

    • S3 Endpoint (e.g.
    • Bucket name
    • Object name (if the request concerns an object)
    • Request type (PUT, GET, etc.)
    • HTTP status code
    • Date and time (timestamp)
    • User-agent (SDK, client, console, etc.)
    • Transaction ID (if possible)
    • Log / trace of the error (if possible)
Docs APIScaleway consoleDedibox consoleScaleway LearningScaleway.comPricingBlogCarreer
© 2023-2024 – Scaleway