aws s3api returns "access denied" if object does not exist and list permissions are not provided

[brandongalbraith]

When attempting to retrieve an object that does not exist from a bucket with aws s3api get-object --bucket <bucket> --key <object_key>, I received:

A client error (AccessDenied) occurred when calling the GetObject operation: Access Denied

instead of:

A client error (NoSuchKey) occurred when calling the GetObject operation: The specified key does not exist.

Only GetObject permissions were provided for the IAM role performing the get-object request.

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Action": [
        "s3:GetObject"
      ],
      "Resource": [
        "arn:aws:s3:::<bucket>/<key_path>/<key_path>/*"
      ],
      "Effect": "Allow"
    }
  ]
}

[JordonPhillips]

This is intentional, it prevents leaking information to parties that are given limited rights to a bucket.

[brandongalbraith]

@JordonPhillips Thanks for the reply! Can you be more specific? If the bucket has the appropriate GetObject permissions, and the object doesn't exist, what information could be leaking by indicating that the object does not exist?

[JordonPhillips]

It gives you information about the bucket's contents that you did not have. You could exhaustively try to grab all possible object keys, and take note of which raises NoSuchKey and which gives AccessDenied. You would then have effectively listed the bucket, which you do not have permissions to do. It would be very difficult and time consuming to do something like that, but a more sophisticated attack could still leak information with far less overhead.

[brandongalbraith]

@JordonPhillips Right you are! Thank you!