AWS AmazonS3 documentation change
Summary
Added documentation about Requester Pays-related 403 errors and required parameters
Security assessment
The change adds guidance about proper configuration for Requester Pays buckets to avoid access denied errors. While it improves security documentation by clarifying access requirements, there is no evidence of addressing an active security vulnerability.
Diff
diff --git a/AmazonS3/latest/userguide/troubleshoot-403-errors.md b/AmazonS3/latest/userguide/troubleshoot-403-errors.md index 449c6de99..ef2cae3e8 100644 --- a//AmazonS3/latest/userguide/troubleshoot-403-errors.md +++ b//AmazonS3/latest/userguide/troubleshoot-403-errors.md @@ -5 +5 @@ -Access denied message examples and how to troubleshoot themBucket policies and IAM policiesAmazon S3 ACL settingsS3 Block Public Access settingsAmazon S3 encryption settingsS3 Object Lock settingsVPC endpoint policiesAWS Organizations policiesCloudFront distribution accessAccess point settingsAdditional resources +Access denied message examples and how to troubleshoot themAccess denied due to Requester Pays settingsBucket policies and IAM policiesAmazon S3 ACL settingsS3 Block Public Access settingsAmazon S3 encryption settingsS3 Object Lock settingsVPC endpoint policiesAWS Organizations policiesCloudFront distribution accessAccess point settingsAdditional resources @@ -31,0 +32,2 @@ For access denied (HTTP `403 Forbidden`) errors, Amazon S3 doesn't charge the bu + * Access denied due to Requester Pays settings + @@ -345,0 +348,20 @@ For more information about these settings, see [Block public access settings](./ +## Access denied due to Requester Pays settings + +If the Amazon S3 bucket you are trying to access has the Requester Pays feature enabled, you need to make sure you are passing the correct request parameters when making requests to that bucket. The Requester Pays feature in Amazon S3 allows the requester, instead of the bucket owner, to pay the data transfer and request costs for accessing objects in the bucket. When Requester Pays is enabled for a bucket, the bucket owner is not charged for requests made by other AWS accounts. + +If you make a request to a Requester Pays-enabled bucket without passing the necessary parameters, you will receive an Access Denied (403 Forbidden) error. To access objects in a Requester Pays-enabled bucket, you must do the following: + + 1. When making requests using the AWS CLI, you must include the `--request-payer requester` parameter. For example, to copy an object with the key `object.txt` located in the `s3://`amzn-s3-demo-bucket`/` S3 bucket to a location on your local machine, you must also pass the parameter `--request-payer requester` if this bucket has Requester Pays enabled. + + aws s3 cp s3://amzn-s3-demo-bucket/object.txt /local/path \ + --request-payer requester + + 2. When making programmatic requests using an AWS SDK, set the `x-amz-request-payer` header to the value `requester`. For an example, see [Downloading objects from Requester Pays buckets](./ObjectsinRequesterPaysBuckets.html). + + 3. Make sure that the IAM user or role making the request has the necessary permissions to access the Requester Pays bucket, such as the `s3:GetObject` and `s3:ListBucket` permissions. + + + + +By including the `--request-payer requester` parameter or setting the `x-amz-request-payer` header, you are informing Amazon S3 that you, the requester, will pay the costs associated with accessing the objects in the Requester Pays-enabled bucket. This will prevent the Access Denied (403 Forbidden) error. +