title: AWS CLI s3 copy fails with 403 error, trying to administrate a user-uploaded object
body: <p>Trying to copy a file from an S3 bucket to my local machine:</p>
  
  <pre><code>aws s3 cp s3://my-bucket-name/audio-0b7ea3d0-13ab-4c7c-ac66-1bec2e572c14.wav ./
  
  fatal error: An error occurred (403) when calling the HeadObject operation: Forbidden 
  </code></pre>
  
  <p>Things I have confirmed:</p>
  
  <ul>
  <li>I'm using version <code>aws-cli/1.11.13 Python/3.5.2 Linux/4.4.0-75-generic botocore/1.4.70</code></li>
  <li>The S3 Object key is correct. I have copied it directly from the S3 web interface.</li>
  <li>The AWS CLI is configured with valid credentials. I generated a new key/secret pair. I deleted the ~/.aws folder before re-configuring the aws cli. The IAM web interface online confirms that the user specific by arn is in fact making use of S3 via the CLI.</li>
  <li>The IAM user is granted the S3 full access managed policy, per <a href="https://stackoverflow.com/questions/36144757/aws-cli-s3-a-client-error-403-occurred-when-calling-the-headobject-operation">this SO post</a>. I removed all this users' policies, and then added only the AWS managed policy called AdministratorAccess, which includes "S3, Full access, All resources."  <strong>Is there a different way to grant access via the CLI? I did not believe so.</strong></li>
  </ul>
  
  <p>Bucket policy is intended to grant wide open access:</p>
  
  <pre><code>    {
          "Sid": "AdminAccess",
          "Effect": "Allow",
          "Principal": "*",
          "Action": [
              "s3:*"
          ],
          "Resource": [
              "arn:aws:s3:::my-bucket-name",
              "arn:aws:s3:::my-bucket-name/*"
          ]
      }
  </code></pre>
  
  <p><strong><em>How did I upload this object?</em></strong></p>
  
  <p>I uploaded this object using AWS Signature v4 signed upload policy from a web app in the client browser directly to AWS.</p>