When using the AWS S3 Console – we are attempting to reorganize some objects in our bucket to a different hierarchy.

We have a Bucket Policy statement that restricts access to the GetObject actions on all objects in the bucket, when they do not originate from the VPC (See policy below), to prevent downloading of objects from resources not running within the VPC.

The user was only successful in being able to perform the move when this statement of the bucket policy was removed from an instance running into the VPC – otherwise was getting 403 Forbidden.

Our speculation about what is going on here is that by using the AWS S3 console, even on a compute resource within the VPC, the requests for the GetObject and PutObject under the hood to perform the move, are being performed by the service on the user’s behalf and by their nature, not originating from the VPC – but not entirely confident.

{
        "Sid": "VpcGetObjectAccessOnly",
        "Effect": "Deny",
        "Principal": "*",
        "Action": "s3:GetObject",
        "Resource": [
            "arn:aws:s3:::XXXX",
            "arn:aws:s3:::XXXXXX/*"
        ],
        "Condition": {
            "StringNotEquals": {
                "aws:SourceVpc": "vpc-YYYYYY"
            }
        }
    }