HTTP 403 Forbidden in AWS S3
Amazon S3 — object storage, often fronting a static site or CDN.
What triggers it in AWS S3
The object exists but bucket policy or an ACL denies public read; or `Block Public Access` is on.
How to fix it on AWS S3
Attach a bucket policy allowing `s3:GetObject` for the intended principals, or use CloudFront + OAC instead of public reads.
Where you'll see it
S3 access logs, CloudFront distribution logs, or the browser response headers (`x-amz-request-id`).
Monitor 403 responses continuously
Lemwatch checks your AWS S3 endpoints as often as every 5 minutes and alerts the moment a 403 pattern appears — with the full response headers and body captured, so you can debug without waiting for the next customer report.
Same error on other platforms
403 Forbidden in AWS S3 — FAQs
The object exists but bucket policy or an ACL denies public read; or `Block Public Access` is on.
Attach a bucket policy allowing `s3:GetObject` for the intended principals, or use CloudFront + OAC instead of public reads.
403 on AWS S3 is a client-side condition, so it will keep returning until the request or configuration is corrected. Retrying the same request without changes will produce the same 403 response.
Pages returning 403 are not indexed by Google. If a previously-indexed page starts returning 403, Google removes it from search results within days to weeks. A sitewide 403 (often from a hosting suspension or firewall misconfig) deindexes the entire site fast. Google does not distinguish between "intentionally locked" and "accidentally locked" — both look like a content disappearance, which damages rankings. If you need to block access to staging or admin pages, use authentication (401) or robots.txt instead of 403 to avoid this signal. On AWS S3 specifically, Googlebot sees the same 403 your users see, so unresolved errors get reflected in Search Console's Page indexing report within days.
Set up an HTTP monitor that pings your key AWS S3 endpoints from multiple regions every 1–5 minutes and alerts on any non-2xx response. Lemwatch does this out of the box — including capturing the full response headers and body when a 403 hits, so you can debug without waiting for the next user report.
Both are client error responses, but they mean different things: 403 Forbidden indicates the server understood the request but refuses to fulfil it — different from 401 in that authentication won't help; you simply don't have permission., while 401 is a distinct condition with its own root cause. On AWS S3, the fix path and the log signature are different — check the exact status code your AWS S3 logs return before applying a fix.