title: AWS returning 403 instead of 404 when object not found
body: <p>I am using IAM role to access S3 and if object is not found then S3 is returning 403. I can see below code in AmazonS3Client. It doesn't cater to 403 and exception is passed to client. </p>
  
  <pre><code>public boolean doesObjectExist(String bucketName, String objectName) throws AmazonServiceException, SdkClientException {
      try {
          this.getObjectMetadata(bucketName, objectName);
          return true;
      } catch (AmazonS3Exception var4) {
          if (var4.getStatusCode() == 404) {
              return false;
          } else {
              throw var4;
          }
      }
  }
  </code></pre>
  
  <p>Below is the policy for IAM role. </p>
  
  <pre><code>{
     "Statement":[
        {
           "Action":[
              "s3:List*"
           ],
           "Resource":"arn:aws:s3:::bucket_name",
           "Effect":"Allow"
        },
        {
           "Action":[
              "s3:Get*",
              "s3:PutObject*",
              "s3:DeleteObject*",
           ],
           "Resource":"arn:aws:s3:::bucket_name/*",
           "Effect":"Allow"
        }
     ]
  }
  </code></pre>
  
  <p>I read somewhere that if object is not found then aws try list and if list permission is not available then throws 403 error. </p>
  
  <p>My question is - what exact change I can do in policy that will stop 403. It is govt client and takes lot of time for any change. if you can help me with precise policy change then it will be great help. My guess is             "s3:ListBucket"
  I am not able to replicate it locally as I can't use IAM role and on other environments I don't have permissions. </p>
  
  <p>edit:
  I already got "s3:List*" for bucket resource. How adding S3:ListBucket to bucket/* will help?</p>