boto.exception.S3ResponseError: S3ResponseError: 403 Forbidden

TL;DR: AWS knows who you are but says no. Your IAM user or role lacks permission for the S3 action, or a bucket policy explicitly denies it. Grant the permission in IAM and retry.

boto.exception.S3ResponseError: S3ResponseError: 403 Forbidden
[?xml version="1.0" encoding="UTF-8"?]
[Error][Code]AccessDenied[/Code][Message]Access Denied[/Message][/Error]

Fix it

1. Identify the IAM identity behind the key (IAM console, access key id). Expected: you know the user or role.
2. Attach a policy allowing the action, e.g. s3:GetObject / s3:ListBucket on the bucket ARN. Expected: policy attached.
3. Check the bucket policy for explicit denies; an explicit deny beats any allow. Expected: no conflicting deny.
4. Retry the S3 call. Expected: 200.

When this applies

• S3ResponseError 403 with AccessDenied on S3 calls.

When it doesn't

• InvalidAccessKeyId in the XML: the key itself is wrong; fix credentials.
• SignatureDoesNotMatch: the secret is wrong.

Compatibility

• boto 2.x (boto3 surfaces the same as ClientError 403).

Why it happens

S3 evaluates IAM policies, bucket policies, and ACLs together. Valid credentials with no allow, or any explicit deny, produce 403.

Edge cases

• KMS-encrypted objects need kms:Decrypt too, not just S3 permissions.
• New buckets in another region: check the endpoint boto uses matches the bucket region.