--- cuppy_hub: aws cuppy_path: reference/s3/bucket-and-object-errors.md cuppy_section: docs cuppy_doc: Y31X-AE2H cuppy_doc_uuid: 6894b635-224e-41f5-8a57-c1ea45339f94 cuppy_permalink: https://cuppy.io/aws/d/Y31X-AE2H cuppy_version: 2 cuppy_updated: 2026-10-23T16:16:52.575Z cuppy_canonical: https://cuppy.io/aws/docs/reference/s3/bucket-and-object-errors cuppy_mcp: https://cuppy.io/mcp cuppy_body_sha256: 3dbd0437d1c5fd2301f9a5d6a9d95f046d25466f0a9048aee561034d945db019 # cuppy_body_sha256 is over the document body ALONE, excluding both generated blocks. --- # Amazon S3 bucket, object and upload errors **S3 errors carry a machine code (``), a human message, the resource, and a request ID.** Search by the code first. A `HEAD` request has no response body, so it returns only the HTTP status. Access denials (403 `AccessDenied`) and region, signature and credential errors are in `reference/s3/errors.md`. ## Bucket and object errors | Code (HTTP) | Message | Cause → fix | Check | |---|---|---|---| | `NoSuchBucket` (404) | The specified bucket does not exist. | Typo, wrong partition, or deleted. Names are global per partition | `aws s3api head-bucket --bucket `: 404 missing, 403 another account's | | `NoSuchKey` (404) | The specified key does not exist. | Wrong key (case, URL-encoding) or not yet written. A 403 instead means you lack `s3:ListBucket` | `aws s3api list-objects-v2 --bucket --prefix ` | | `BucketAlreadyExists` (409) | The requested bucket name is not available… | Another account owns the name; choose another, or use your account regional namespace | `aws s3api head-bucket --bucket `: 403 means another account | | `BucketAlreadyOwnedByYou` (409) | The bucket that you tried to create already exists, and you own it… | Treat as success in IaC; note us-east-1 does not return this error | None needed | | `BucketNotEmpty` (409) | The bucket that you tried to delete is not empty. | Delete all objects (and versions) first | `aws s3api list-object-versions --bucket --max-items 5` | | `InvalidBucketName` (400) | The specified bucket is not valid. | Breaks naming rules: `reference/s3/buckets-and-objects.md` | The name against the rules | | `TooManyBuckets` (400) | You have attempted to create more buckets than are allowed for an account… | The account's bucket quota; read the current value before requesting more | Service Quotas for S3; `aws s3api list-buckets --query 'length(Buckets)'` | | `AccessControlListNotSupported` (400) | The bucket does not allow ACLs. | Bucket owner enforced (the default): drop the ACL header, or send only `bucket-owner-full-control` | `aws s3api get-bucket-ownership-controls --bucket ` | | `OwnershipControlsNotFoundError` (404) | The bucket ownership controls were not found. | No Object Ownership setting on an older bucket; set one | Same call | | `NoSuchBucketPolicy` (404) | The specified bucket does not have a bucket policy. | Normal on `GetBucketPolicy` for a bucket without one | `aws s3api head-bucket --bucket `: 404 missing, 403 another account's | | `MalformedPolicy` (400) | Your policy contains a principal that is not valid. | Bad or deleted principal in the bucket policy: `patterns/iam/trust-policies.md` (same rules) | Each principal ARN in the policy still exists (`aws iam get-role` / `get-user`) | | `InvalidObjectState` (403) | The operation is not valid for the current state of the object. | Often an object in an archive storage class that must be restored first (UNVERIFIED in the collected sources) | `aws s3api head-object --bucket --key ` → `StorageClass`, `Restore` | | `MethodNotAllowed` (405) | The specified method is not allowed against this resource. | Operation not valid for that resource | The operation against the resource type (a delete marker, a directory bucket) | | `PreconditionFailed` (412) | At least one of the preconditions that you specified did not hold. | `If-Match` / `If-None-Match` condition false; refetch and retry | `head-object` → `ETag`, `LastModified` vs your conditions | | `AllAccessDisabled` (403) | All access to this Amazon S3 resource has been disabled… | Account-level action by AWS; contact Support | None: contact Support | ## Upload errors | Code (HTTP) | Cause → fix | Check | |---|---|---| | `EntityTooLarge` (400) | Larger than allowed for the request type; use multipart upload (`guides/s3/upload-large-objects.md`) | The object's size against the request type's limit | | `EntityTooSmall` (400) | A non-final multipart part under 5 MiB | `aws s3api list-parts --bucket --key --upload-id ` → `Size` of every part but the last | | `InvalidPart` (400) | A listed part was not uploaded or its ETag does not match | Same call → `PartNumber`, `ETag` vs the list you sent | | `InvalidPartOrder` (400) | Parts list not in ascending part-number order | Same call → `PartNumber`, `ETag` vs the list you sent | | `NoSuchUpload` (404) | Upload ID invalid, or the upload was already completed or aborted | `aws s3api list-multipart-uploads --bucket --prefix ` | | `InvalidRequest` (400) | Several causes, including `CopyObject` on an object over 5 GB (use multipart copy) and wrong signature version | The message names the cause | | `KMS.DisabledException` / `KMS.NotFoundException` / `KMS.KMSInvalidStateException` / `KMS.InvalidKeyUsageException` (400) | The bucket's or request's KMS key is disabled, missing, in a bad state or the wrong key type; fix the key or the encryption setting | `aws s3api get-bucket-encryption --bucket `, then `aws kms describe-key --key-id ` → `KeyState`, `KeySpec` | ## Throttling `SlowDown` (503): reduce the request rate and retry with backoff. Check: SDK retry logs show 503s clustered on one key prefix. Bucket owners are not billed for 5XX responses. ## When none of these fits Collect the `RequestId` and the exact message, and search the hub for the message. AWS Support can trace a request from its request ID. --- You are reading one file. The same content is free over MCP at https://cuppy.io/mcp with no signup: ranked search across all 131 documents in this hub, the merged view when you work in a layer, known workarounds matched to the error you hit, and depth control so you spend tokens on what you need. Start with the `_hello` tool. How to connect: https://cuppy.io/aws/ Something wrong in this document? Report it with the `session feedback` tool on the same endpoint.