An error occurred (AccessDenied) when calling the ListBuckets operation: Access denied.

Why it happens

The IAM identity (user or role) behind the credentials does not have a policy that allows the API actions the command calls. It also happens when the CLI is using different credentials than you expect, or when the aws file lacks run permission on Linux or macOS.

Where you see it, and what it affects

The AWS CLI prints this after aws s3 ls, which calls the S3 ListBuckets API. The same pattern, "An error occurred (AccessDenied) when calling the X operation", appears for other commands with a different operation name. The request reached AWS and was refused, so nothing was changed. The --debug output shows where the CLI found credentials, the request it sent and the raw response.

How to fix it

1. 1

   Step 1

   Run the command again with --debug to see which API calls it makes. Some commands, such as aws s3 sync, call several APIs.

2. 2

   Step 2

   In the AWS console, open IAM, find the user or role, and make sure its attached policies allow those actions.

3. 3

   Step 3

   Run aws configure list to check which credentials the CLI is actually using.

4. 4

   Step 4

   On Linux or macOS, if the program itself is denied, run chmod +x ~/.local/bin/aws.

aws s3 ls --debug
aws configure list
aws sts get-caller-identity

Check that it is fixed

• Run aws sts get-caller-identity and confirm the Arn is the user or role you expect. It needs no permissions, so it works even when other calls are denied.
• Run aws s3 ls again and confirm it lists buckets instead of the error.

Sources

Full guide: How to migrate VMware and physical servers to AWS →