# S3 403: find the denying layer
## The rule
"AccessDenied" from S3 is five different problems wearing one error message. Check each layer.
## The layers
1. IAM policy on the caller: s3:GetObject and friends on the right bucket and key ARNs.
2. Bucket policy: the bucket side can deny explicitly, and can also require conditions like encryption or VPC source.
3. Block Public Access: if the request looks public and the block is on, it denies regardless of policy.
4. Object Ownership: with BucketOwnerEnforced, ACLs are disabled entirely, so old ACL-based grants silently stop working.
5. KMS: objects encrypted with SSE-KMS need kms:Decrypt (and kms:GenerateDataKey for writes) on the key itself, granted in the key policy or IAM. This is the layer everyone forgets, because the error says S3 while the denial lives in KMS.
## Procedure
1. Reproduce with the AWS CLI and --debug to see the exact request.
2. Temporarily test with an admin-scoped role in a sandbox to isolate policy from code bugs. Narrow back down after.
3. Fix exactly one layer, retest, repeat. Changing IAM and the bucket policy at once teaches you nothing.