Root user is denied downloading from s3 bucket - amazon-web-services

Question

Using s3cmd after configuring with my root privileges (access key and secret key), whenever I try to download something from a bucket using sync or get , I receive this strange error of permission for my root account:
WARNING: Remote file S3Error: 403 (Forbidden):
The owner is another user I have made using IAM console, but am I correct to expect that the root user should always get full and unrestricted access?
Also using aws-cli i get an unknown error
A client error (Unknown) occurred when calling the GetObject operation: Unknown
Also I thought I had to add a bucket policy to allow for root access (as strange as it sounds), as the first step I added annonymous access with this policy
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Principal": "*",
"Action": [
"s3:GetObject"
],
"Resource": [
"arn:aws:s3:::myBucket/*"
]
}
]
}
But still the errors are the same as above. The owner of the bucket is also the root user (the one trying to access is the same as owner). What am I understanding wrong here? How can I restore root user's access to my own bucket that was made by one of my own IAM users?

Answer 1

For any of the S3 read permissions to work, you need not just allow those objects but also allow ListBucket on the bucket(s), ListAllMyBuckets and GetBucketLocation, my consolidated version:
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": "s3:ListAllMyBuckets",
"Resource": "arn:aws:s3:::*"
},
{
"Effect": "Allow",
"Principal": "*",
"Action": [
"s3:Get*",
"s3:List*"
],
"Resource": [
"arn:aws:s3:::myBucket/*",
"arn:aws:s3:::myBucket"
]
}
]
}
See more examples at AWS IAM Documentation

Answer 2

It is always a good idea to recheck the status of storage, and whether S3 has been under a life cycle, so that in this case it could have been transferred to Glacier. Here, I tried to access a Glacier object using s3cmd commands, and I received uninformative and irrelevant permission errors. It would be a good idea to add this as an enhancement to future versions of s3cmd to get better warning/error messages.