S3 error: Access Denied (deployment bucket)

WHAT IT MEANS

What this error means

• An error occurred (ValidationError) when calling the CreateChangeSet operation: S3 error: Access Denied — the readback direction: CloudFormation, not your CLI, could not fetch the artifacts.
• An error occurred (AccessDenied) when calling the PutObject operation while uploading — the upload direction: your deploy credentials cannot write to the bucket.

Common causes, roughly in order of frequency:

• a samconfig.toml s3_bucket pointing at a bucket in the wrong Region;
• a bucket owned by another account (shared or copied config);
• SSE-KMS on the bucket without matching key permissions for the deploy identity;
• a bucket policy or Block Public Access change that tightened access after the bucket was configured.

FIX

How to fix it

1. Separate the directions (read-only):

   aws s3api head-object --bucket my-deploy-bucket --key path/from/the/error

   If your credentials can read the object, the upload worked and the failure is CloudFormation's readback — look at bucket policy and KMS. If head-object is denied too, the problem is your deploy identity's access.
2. Catch the wrong-Region bucket:

   aws s3api get-bucket-location --bucket my-deploy-bucket

   The bucket's Region must match the Region you deploy to; SAM's managed bucket (--resolve-s3) avoids this class entirely.
3. Check encryption:

   aws s3api get-bucket-encryption --bucket my-deploy-bucket

   SSE-KMS buckets need the deploy identity to hold key permissions alongside the S3 permissions.
4. Confirm ownership before touching policy. If the bucket belongs to another account, coordinate rather than widening a policy you do not own.

AUTOMATE THE TRIAGE

Diagnose this automatically

SAM Doctor recognizes both directions (high confidence) and keeps IAM-worded denials with the IAM rules, which name the policy layer instead. Runs locally; no AWS access, no log upload.

python -m pip install sam-doctor
sam-doctor diagnose deployment.log --format markdown

RELATED

Related errors

• Access denied with an explicit deny — when the denial names a policy layer instead of S3.
• BucketAlreadyExists — the other way an S3 bucket stops a deploy cold.