运行s3cmd info访问S3存储桶时出现403权限拒绝问题求助

在AlmaLinux系统上使用s3cmd 2.3.0版本时，可正常下载及同步文件至指定S3存储桶，但执行s3cmd info s3://bucketname命令时触发403 AccessDenied错误；升级至2.4.0版本后仍报错。当前绑定的存储桶策略如下，需要修改哪些权限或配置才能正常使用该命令？

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "VisualEditor0",
            "Effect": "Allow",
            "Action": [
                "s3:ListBucket",
                "s3:PutObject",
                "s3:GetObject",
                "s3:PutObjectAcl"
            ],
            "Resource": [
                "arn:aws:s3:::bucketname",
                "arn:aws:s3:::bucketname/*"
            ]
        },
        {
            "Effect": "Allow",
            "Action": [
                "s3:GetBucketPolicyStatus",
                "s3:GetBucketPublicAccessBlock",
                "s3:GetBucketTagging",
                "s3:GetBucketWebsite",
                "s3:ListBucketVersions",
                "s3:GetBucketLogging",
                "s3:GetBucketVersioning",
                "s3:GetBucketAcl",
                "s3:GetBucketNotification",
                "s3:GetBucketPolicy",
                "s3:GetBucketObjectLockConfiguration",
                "s3:GetBucketRequestPayment",
                "s3:GetBucketCors",
                "s3:GetBucketOwnershipControls",
                "s3:GetBucketLocation"
            ],
            "Resource": [
                "arn:aws:s3:::*",
                "arn:aws:s3:::bucketname",
                "arn:aws:s3:::bucketname/*"
            ]
        }
    ]
}

2.4.0版本报错信息：

s3://bucketname/ (bucket):
   Location:  us-east-1
   Payer:     BucketOwner
   Ownership: BucketOwnerEnforced
   Versioning:none
ERROR: Access to bucket 'bucketname' was denied
ERROR: S3 error: 403 (AccessDenied): Access Denied

问题出在s3cmd info命令需要查询桶的加密配置，但当前策略未授予对应权限。新版本s3cmd执行info操作时，会额外请求s3:GetBucketEncryption权限，现有策略缺少这个权限才触发了403错误。

修改方法很简单，把s3:GetBucketEncryption添加到第二个Statement的Action列表中即可：

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "VisualEditor0",
            "Effect": "Allow",
            "Action": [
                "s3:ListBucket",
                "s3:PutObject",
                "s3:GetObject",
                "s3:PutObjectAcl"
            ],
            "Resource": [
                "arn:aws:s3:::bucketname",
                "arn:aws:s3:::bucketname/*"
            ]
        },
        {
            "Effect": "Allow",
            "Action": [
                "s3:GetBucketPolicyStatus",
                "s3:GetBucketPublicAccessBlock",
                "s3:GetBucketTagging",
                "s3:GetBucketWebsite",
                "s3:ListBucketVersions",
                "s3:GetBucketLogging",
                "s3:GetBucketVersioning",
                "s3:GetBucketAcl",
                "s3:GetBucketNotification",
                "s3:GetBucketPolicy",
                "s3:GetBucketObjectLockConfiguration",
                "s3:GetBucketRequestPayment",
                "s3:GetBucketCors",
                "s3:GetBucketOwnershipControls",
                "s3:GetBucketLocation",
                "s3:GetBucketEncryption"  // 新增该权限
            ],
            "Resource": [
                "arn:aws:s3:::*",
                "arn:aws:s3:::bucketname",
                "arn:aws:s3:::bucketname/*"
            ]
        }
    ]
}

添加完成后，重新执行s3cmd info s3://bucketname命令，就能正常获取完整的桶信息，不会再出现403错误。

内容的提问来源于stack exchange，提问作者Out of Control