AWS S3/SES: Access Denied
The Problem: Your SpaceDF instance connects to AWS successfully (keys are correct), but actions like Uploading Files or Sending Emails fail because the IAM User lacks the necessary permission policies.
1. Symptoms & Diagnosis
You will see specific error messages in your backend logs depending on which service is blocked.
Run docker compose logs -f backend to check:
| Service | Feature Impact | Log Error Message Example |
|---|---|---|
| S3 Storage | Cannot upload avatars, device images. | Access Denied, Status Code: 403User is not authorized to perform: s3:PutObject |
| SES Email | Registration emails or alerts are not sent. | MessageRejectedUser ... is not authorized to perform: ses:SendEmail |
2. The Fix: Add Missing Policies
You do not need to create a new user or generate new keys. You simply need to attach the missing policies to your existing IAM User.
Open AWS IAM Console
Log in to your AWS Console.
Navigate to IAM > Users .
Click on the user name you created for SpaceDF (e.g., spacedf-user).
Attach Permissions
Go to the Permissions tab.
Click the Add permissions button (Dropdown) > Select Add permissions.
Select the box: Attach policies directly.
Select & Save
Search for and check the specific policy matching your error:
- For S3 Errors: Search
S3> CheckAmazonS3FullAccess. - For SES Errors: Search
SES> CheckAmazonSESFullAccess.
Click Next and then Add permissions to confirm.
3. Verification
Once the policies are attached, the effect is immediate (mostly). You can try the action again without restarting SpaceDF.
Still having issues?
- Wrong Keys: Did you accidentally use the keys of a different IAM user in your
.env? - Bucket Name: For S3, ensure
AWS_S3_BUCKETin.envmatches your actual bucket name exactly. - Sandox Mode: For SES, if you get
Email address is not verified, your AWS account might still be in SES Sandbox mode. You must verify the “From” address or request a production limit increase.
If you added the permissions but still get errors, check:
Original Setup Guide For the complete setup instructions including screenshots, refer back to the AWS Configuration Section.