Amazon S3 bucket, object and upload errors
Look up an S3 bucket, object, multipart-upload, KMS or throttling error by its code — NoSuchBucket, NoSuchKey, BucketAlreadyExists, BucketNotEmpty, AccessControlListNotSupported, InvalidObjectState, PreconditionFailed, EntityTooLarge, InvalidPart, NoSuchUpload, KMS.DisabledException, SlowDown — with S3's message, the cause, the call that confirms it, and the fix.
markdownreferencev2Y31X-AE2Hstage: operatetrust: officialservice: s3interface: anyNoSuchBucketNoSuchKeyBucketAlreadyExistsBucketAlreadyOwnedByYouBucketNotEmptyInvalidBucketNameTooManyBucketsAccessControlListNotSupportedOwnershipControlsNotFoundErrorNoSuchBucketPolicyMalformedPolicy S3InvalidObjectStateMethodNotAllowedPreconditionFailed S3AllAccessDisabledEntityTooLargeEntityTooSmallInvalidPartInvalidPartOrderNoSuchUploadInvalidRequest CopyObject 5 GBKMS.DisabledExceptionKMS.NotFoundExceptionSlowDownS3 503
S3 errors carry a machine code (<Code>), a human message, the resource, and a request ID. Search by the code first. A HEAD request has no response body, so it returns only the HTTP status. Access denials (403 AccessDenied) and region, signature and credential errors are in reference/s3/errors.md.
Bucket and object errors
| Code (HTTP) | Message | Cause → fix | Check |
|---|---|---|---|
NoSuchBucket (404) | The specified bucket does not exist. | Typo, wrong partition, or deleted. Names are global per partition | aws s3api head-bucket --bucket <b>: 404 missing, 403 another account's |
NoSuchKey (404) | The specified key does not exist. | Wrong key (case, URL-encoding) or not yet written. A 403 instead means you lack s3:ListBucket | aws s3api list-objects-v2 --bucket <b> --prefix <key> |
BucketAlreadyExists (409) | The requested bucket name is not available… | Another account owns the name; choose another, or use your account regional namespace | aws s3api head-bucket --bucket <b>: 403 means another account |
BucketAlreadyOwnedByYou (409) | The bucket that you tried to create already exists, and you own it… | Treat as success in IaC; note us-east-1 does not return this error | None needed |
BucketNotEmpty (409) | The bucket that you tried to delete is not empty. | Delete all objects (and versions) first | aws s3api list-object-versions --bucket <b> --max-items 5 |
InvalidBucketName (400) | The specified bucket is not valid. | Breaks naming rules: reference/s3/buckets-and-objects.md | The name against the rules |
TooManyBuckets (400) | You have attempted to create more buckets than are allowed for an account… | The account's bucket quota; read the current value before requesting more | Service Quotas for S3; aws s3api list-buckets --query 'length(Buckets)' |
AccessControlListNotSupported (400) | The bucket does not allow ACLs. | Bucket owner enforced (the default): drop the ACL header, or send only bucket-owner-full-control | aws s3api get-bucket-ownership-controls --bucket <b> |
OwnershipControlsNotFoundError (404) | The bucket ownership controls were not found. | No Object Ownership setting on an older bucket; set one | Same call |
NoSuchBucketPolicy (404) | The specified bucket does not have a bucket policy. | Normal on GetBucketPolicy for a bucket without one | aws s3api head-bucket --bucket <b>: 404 missing, 403 another account's |
MalformedPolicy (400) | Your policy contains a principal that is not valid. | Bad or deleted principal in the bucket policy: patterns/iam/trust-policies.md (same rules) | Each principal ARN in the policy still exists (aws iam get-role / get-user) |
InvalidObjectState (403) | The operation is not valid for the current state of the object. | Often an object in an archive storage class that must be restored first (UNVERIFIED in the collected sources) | aws s3api head-object --bucket <b> --key <k> → StorageClass, Restore |
MethodNotAllowed (405) | The specified method is not allowed against this resource. | Operation not valid for that resource | The operation against the resource type (a delete marker, a directory bucket) |
PreconditionFailed (412) | At least one of the preconditions that you specified did not hold. | If-Match / If-None-Match condition false; refetch and retry | head-object → ETag, LastModified vs your conditions |
AllAccessDisabled (403) | All access to this Amazon S3 resource has been disabled… | Account-level action by AWS; contact Support | None: contact Support |
Upload errors
| Code (HTTP) | Cause → fix | Check |
|---|---|---|
EntityTooLarge (400) | Larger than allowed for the request type; use multipart upload (guides/s3/upload-large-objects.md) | The object's size against the request type's limit |
EntityTooSmall (400) | A non-final multipart part under 5 MiB | aws s3api list-parts --bucket <b> --key <k> --upload-id <id> → Size of every part but the last |
InvalidPart (400) | A listed part was not uploaded or its ETag does not match | Same call → PartNumber, ETag vs the list you sent |
InvalidPartOrder (400) | Parts list not in ascending part-number order | Same call → PartNumber, ETag vs the list you sent |
NoSuchUpload (404) | Upload ID invalid, or the upload was already completed or aborted | aws s3api list-multipart-uploads --bucket <b> --prefix <k> |
InvalidRequest (400) | Several causes, including CopyObject on an object over 5 GB (use multipart copy) and wrong signature version | The message names the cause |
KMS.DisabledException / KMS.NotFoundException / KMS.KMSInvalidStateException / KMS.InvalidKeyUsageException (400) | The bucket's or request's KMS key is disabled, missing, in a bad state or the wrong key type; fix the key or the encryption setting | aws s3api get-bucket-encryption --bucket <b>, then aws kms describe-key --key-id <k> → KeyState, KeySpec |
Throttling
SlowDown (503): reduce the request rate and retry with backoff. Check: SDK retry logs show 503s clustered on one key prefix. Bucket owners are not billed for 5XX responses.
When none of these fits
Collect the RequestId and the exact message, and search the hub for the message. AWS Support can trace a request from its request ID.