[BUG] S3 bucket policy Allow statements are not honored independently — same-account access requires identity policy to also explicitly grant the action

[varunn-ranaa]

Service

S3

AWS API Action

PutObject (via aws s3 cp / aws s3api put-object)

Expected behavior

For same-account access, AWS S3 authorization only requires an explicit Allow in either the bucket policy or the IAM identity policy — not both — as long as neither policy has an explicit Deny. This is documented directly by AWS:

For same-account access, there must not be an explicit Deny statement against the requester... in either the bucket policy or the IAM user policy. If you want to grant permissions by using only the bucket policy and the IAM user policy, there must be at least one explicit Allow statement in one of these policies.
— [AWS: Troubleshoot Access Denied (403 Forbidden) errors in Amazon S3](https://docs.aws.amazon.com/AmazonS3/latest/userguide/troubleshoot-403-errors.html)

The "both policies must allow" rule only applies to cross-account access, not same-account.

So: a same-account IAM user (developer01) with no identity policy at all, where the bucket owner (same account) has an explicit bucket policy Allow naming that user for s3:PutObject, should be able to successfully PutObject.

Actual behavior

Floci returns AccessDenied for a same-account user relying solely on a bucket policy grant, with no identity policy attached at all.

An error occurred (AccessDenied) when calling the PutObject operation: User is not authorized to perform: s3:PutObject

This happens even though:

• Both FLOCI_SERVICES_IAM_ENFORCEMENT_ENABLED=true and FLOCI_SERVICES_S3_ENFORCE_AUTH=true are set
• The bucket policy explicitly names the user as principal and allows the action
• The user and bucket are in the same account (000000000000)
• The user's identity policy list is confirmed empty (list-attached-user-policies returns [])

For comparison, attaching an identity policy that explicitly grants s3:PutObject (in addition to, or instead of, the bucket policy) succeeds — confirming enforcement itself works, but bucket-policy-only grants are not honored for same-account principals.

Reproduction

export AWS_PROFILE=floci-deployer

# Create the target bucket
aws s3 mb s3://aws-my-bucket --endpoint-url http://localhost:4566

# Create a same-account IAM user
aws iam create-user --user-name developer01 --endpoint-url http://localhost:4566
aws iam create-access-key --user-name developer01 --endpoint-url http://localhost:4566
# (configure a CLI profile "developer01" with the returned keys)

# Bucket policy: explicitly allow developer01 to GetObject/PutObject
cat > bucketpolicy.json << 'EOF'
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {
        "AWS": "arn:aws:iam::000000000000:user/developer01"
      },
      "Action": ["s3:GetObject", "s3:PutObject"],
      "Resource": "arn:aws:s3:::aws-my-bucket/*"
    }
  ]
}
EOF

aws s3api put-bucket-policy \
  --bucket aws-my-bucket \
  --policy file://bucketpolicy.json \
  --endpoint-url http://localhost:4566

# Confirm developer01 has ZERO identity policies attached
aws iam list-attached-user-policies \
  --user-name developer01 \
  --endpoint-url http://localhost:4566
# → { "AttachedPolicies": [] }

# Confirm the bucket policy is in place
aws s3api get-bucket-policy \
  --bucket aws-my-bucket \
  --endpoint-url http://localhost:4566

# Attempt PutObject as developer01 (bucket-policy-only, no identity policy)
export AWS_PROFILE=developer01
aws s3 cp ./one.txt s3://aws-my-bucket/one.txt --endpoint-url http://localhost:4566

Result: AccessDenied, when it should succeed per same-account bucket-policy semantics.

Tried it with attaching identity policy to user which allow only GetObject, still user access denied.

Control test (works correctly): attaching an identity policy that explicitly includes s3:PutObject for the same user, same bucket, same bucket policy — succeeds. This isolates the bug specifically to bucket-policy-only grants not being honored, not a general enforcement failure.

Environment

• Floci version / image tag: floci/floci:latest (2.1.0 native, Quarkus 3.39.2)
• AWS CLI version: aws-cli/2.31.35
• How you're running Floci: Docker
• Relevant env vars confirmed active:

  FLOCI_SERVICES_IAM_ENFORCEMENT_ENABLED=true
  FLOCI_SERVICES_IAM_SEED_DEPLOYER_PRINCIPAL=true
  FLOCI_SERVICES_S3_ENFORCE_AUTH=true