title: aws s3 cp returns An error occurred (403) when calling the HeadObject operation: Forbidden
body: <h3>Foreword</h3>
  
  <p>I guess it may be a duplication but other posts with the same problem didn't help me much.</p>
  
  <h3>A problem</h3>
  
  <p><code>aws s3 cp s3://s3-us-west-2.amazonaws.com/my-test-bucket/intro.jpg test.jpg</code><br>
  Outputs the following:<br>
  <code>fatal error: An error occurred (403) when calling the HeadObject operation: Forbidden</code></p>
  
  <p>Bucket Policy:</p>
  
  <pre><code>{
      "Version": "2012-10-17",
      "Id": "Policy1539624480514",
      "Statement": [
          {
              "Sid": "Stmt1539624478431",
              "Effect": "Allow",
              "Principal": "*",
              "Action": "s3:*",
              "Resource": [
                  "arn:aws:s3:::my-test-bucket",
                  "arn:aws:s3:::my-test-bucket/*"
              ]
          }
      ]
  }
  </code></pre>
  
  Some notes
  
  <ol>
  <li><code>intro.jpg</code> was added by user A (who has AdministratorAccess) via AWS Console Dashboard (it's not copy file between buckets)</li>
  <li><p><code>aws sts get-caller-identity</code> returns me information about user A
  <div class="snippet" data-lang="js" data-hide="false" data-console="true" data-babel="false">
  <div class="snippet-code">
  <pre class="snippet-code-js lang-js prettyprint-override"><code>{
      "UserId": "AIDXXXX3KDQHYYYYXRLO",
      "Account": "765123991235",
      "Arn": "arn:aws:iam::765123991235:user/john.doe@example.com"
  }</code></pre>
  </div>
  </div>
  </p></li>
  <li><p><code>cat ~/.aws/config</code></p></li>
  </ol>
  
  <p><div class="snippet" data-lang="js" data-hide="false" data-console="true" data-babel="false">
  <div class="snippet-code">
  <pre class="snippet-code-js lang-js prettyprint-override"><code>[default]
  region = us-west-2
  output = json</code></pre>
  </div>
  </div>
  </p>
  
  <ol start="4">
  <li><code>cat ~/.aws/credentials</code> points to user A access key and secret</li>
  </ol>
  
  <p><div class="snippet" data-lang="js" data-hide="false" data-console="true" data-babel="false">
  <div class="snippet-code">
  <pre class="snippet-code-js lang-js prettyprint-override"><code>[default]
  aws_access_key_id = AZZZIXXXXJQZA6YYYYUQ
  aws_secret_access_key = &lt;&lt;&lt;&lt;&lt;&lt;&lt;&lt;&lt;KEY REMOVED&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;</code></pre>
  </div>
  </div>
  </p>
  
  <ol start="5">
  <li><code>aws s3 ls</code> returns the correct list of buckets  </li>
  <li>time is synced on my local machine correctly</li>
  </ol>