title: S3ResponseError: 403 Forbidden using Boto
body: <p>I have a permission problem on an S3 bucket when I try to access certain files using BOTO in Python. Here is the bucket policy :</p>
  
  <pre><code>{
      "Version": "2008-10-17",
      "Id": "Policy1407346649831",
      "Statement": [
          {
              "Sid": "Stmt1407346646598",
              "Effect": "Allow",
              "Principal": {
                  "AWS": "arn:aws:iam::029030651757:user/my_iam_user"
              },
              "Action": "s3:*",
              "Resource": ["arn:aws:s3:::my_bucket/*",
                           "arn:aws:s3:::my_bucket"]
          },
          {
              "Sid": "2",
              "Effect": "Allow",
              "Principal": {
                  "AWS": "arn:aws:iam::cloudfront:user/CloudFront Origin Access Identity EFUS443HMBYF"
              },
              "Action": "s3:GetObject",
              "Resource": ["arn:aws:s3:::my_bucket/*",
                           "arn:aws:s3:::my_bucket"]
          },
          {
              "Sid": "3",
              "Effect": "Allow",
              "Principal": {
                  "AWS": "arn:aws:iam::cloudfront:user/CloudFront Origin Access Identity EFUS443HMBYF"
              },
              "Action": "s3:PutObject",
              "Resource": "arn:aws:s3:::my_bucket/*"
          }
      ]
  }
  </code></pre>
  
  <p>I have 3 statements. The first one is to authorize the user <code>my_iam_user</code> to access the bucket <code>my_bucket</code>, the second one is to authorize a Cloudfront distribution to read the bucket and the last one is to authorize a Cloudfront distribution to write on the bucket.</p>
  
  <p>Now I have to files on my bucket <code>profile_pictures/15/file1.jpg</code> and <code>profile_pictures/15/file2.jpg</code>. The first one was created using a signed url and CloudFront, the second one was put on the S3 using Boto. Now I try to access the files using Boto. Here is my code:</p>
  
  <pre><code>import boto
  from boto.s3.key import Key
  
  s3 = boto.connect_s3(
      aws_access_key_id="access_key_of_my_iam_user",
      aws_secret_access_key="secret_key_of_my_iam_user"
  )
  bucket = s3.get_bucket("my_bucket", validate=False)
  
  k1 = Key(bucket)
  k1.key = "profile_pictures/15/file1.jpg"
  k1.get_contents_as_string()
  
  
  k2 = Key(bucket)
  k2.key = "profile_pictures/15/file2.jpg"
  k2.get_contents_as_string()
  </code></pre>
  
  <p>The problem is that the access to file1 returns an error:</p>
  
  <pre><code>S3ResponseError: S3ResponseError: 403 Forbidden
  &lt;?xml version="1.0" encoding="UTF-8"?&gt;
  &lt;Error&gt;&lt;Code&gt;AccessDenied&lt;/Code&gt;&lt;Message&gt;Access Denied&lt;/Message&gt;&lt;RequestId&gt;8C5DE910C7B18F9E&lt;/RequestId&gt;&lt;HostId&gt;XiKU5Q+B0Wme3GpUNmUoD9KpUN63T3bFu/rAb/wh3rhDMkykoRsdQIFgyIp8zfAwMR1apbqUEFY=&lt;/HostId&gt;&lt;/Error&gt;
  </code></pre>
  
  <p>whereas the second one is a success. What could be wrong?</p>
  
  <p>Note: The time on the client that is running the code is good.</p>