title: boto3 Access Denied S3 put_object with correct permissions
body: <p>First time boto3 user. </p>
  
  <p>I had a user with ACL S3FullAccess and used the following code to try and upload a file; it uses a pandas DataFrame as the source.</p>
  
  <pre><code>        s3_client = boto3.client('s3')
          io = StringIO()
          df.to_csv(io)
          response = s3_client.put_object(
              Bucket=self.bucket,
              Body=io,
              Key=self.filename
          )
  </code></pre>
  
  <p>This lead to this response</p>
  
  <pre><code>botocore.exceptions.ClientError: An error occurred (AccessDenied) when calling the PutObject operation: Access Denied
  </code></pre>
  
  <p>So I checked that the secret key and access key were being picked up by boto3 from my ~/.aws/credentials file, and they are, on line 604 of client.py in boto3 - request_signer=self._request_signer</p>
  
  <p>So I researched here on SO, and it seemed a lot of people had to add a Policy document, so I did that as follows:</p>
  
  <pre><code>{
  "Version": "2012-10-17",
  "Id": "Policyxxx",
  "Statement": [
      {
          "Sid": "Stmtx1",
          "Effect": "Allow",
          "Principal": {
              "AWS": "arn:aws:iam::&lt;12 digit id&gt;:root"
          },
          "Action": [
              "s3:GetObject",
              "s3:PutObject"
          ],
          "Resource": "arn:aws:s3:::&lt;my-bucket&gt;/*"
      },
      {
          "Sid": "Stmtx6",
          "Effect": "Allow",
          "Principal": {
              "AWS": "arn:aws:iam::&lt;12 digit id&gt;:root"
          },
          "Action": "s3:ListBucket",
          "Resource": "arn:aws:s3:::&lt;my-bucket&gt;"
      }
  ]
  }
  </code></pre>
  
  <p>I still get the same error, so I added this to my put_object call since the S3 bucket uses AES-256 encryption, which I thought was server-side only, but running out of ideas, so worth a try.</p>
  
  <pre><code>            SSECustomerKey=os.urandom(32),
              SSECustomerAlgorithm='AES256',
  </code></pre>
  
  <p>Next I removed those terms associated with the SSE keys, realising that the AES-256 encryption is server side and should not affect my access. </p>
  
  <p>Then I tried to generate a new pair of Access keys and use those instead, same result. </p>
  
  <p>Does anyone have any idea what I might look at next, what have I missing in the hundreds of pages of AWS documentation?</p>