{"record":{"id":"ca0fe187f8c97e1d","repo":"Budibase/budibase","slug":"access-denied-to-object-store-bucket-err","errorCode":null,"errorMessage":"Access denied to object store bucket.${err}","messagePattern":"Access denied to object store bucket\\.(.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"critical","filePath":"packages/backend-core/src/objectStore/objectStore.ts","lineNumber":186,"sourceCode":"  client: any,\n  bucketName: string\n): Promise<{ created: boolean; exists: boolean }> {\n  bucketName = sanitizeBucket(bucketName)\n  try {\n    await client.headBucket({\n      Bucket: bucketName,\n    })\n    return { created: false, exists: true }\n  } catch (err: any) {\n    const statusCode =\n      err.statusCode ||\n      err.$response?.statusCode ||\n      err.$metadata?.httpStatusCode\n    const promises: Record<string, Promise<any> | undefined> =\n      STATE.bucketCreationPromises\n\n    if (statusCode === 403) {\n      throw new Error(\"Access denied to object store bucket.\" + err)\n    }\n\n    if (promises[bucketName]) {\n      await promises[bucketName]\n      return { created: false, exists: true }\n    }\n\n    // Attempt to create the bucket for any headBucket failure that is not an\n    // explicit access denial. This covers 404 (not found) and non-standard\n    // status codes returned by S3-compatible stores such as Ceph RadosGW.\n    promises[bucketName] = client\n      .createBucket({\n        Bucket: bucketName,\n      })\n      .catch((err: any) => {\n        // bucket was created in the meantime by another process\n        if (\n          err.Code !== \"BucketAlreadyOwnedByYou\" &&","sourceCodeStart":168,"sourceCodeEnd":204,"githubUrl":"https://github.com/Budibase/budibase/blob/a81a902e9a8fe55b467d106765f6638f12e35c49/packages/backend-core/src/objectStore/objectStore.ts#L168-L204","documentation":"createBucketIfNotExists catches errors from the S3 CreateBucket call; when the SDK reports HTTP status 403 it rethrows as 'Access denied to object store bucket.' meaning the configured credentials are not permitted to create (or access) the bucket. Other statuses fall through to promise-dedup/existence handling.","triggerScenarios":"Any path that lazily creates a bucket (deleteFile, deleteFiles, importObjects, bucketCreated hooks) hitting an S3/MinIO API that returns 403 — wrong credentials, missing s3:CreateBucket permission, or bucket owned by another account.","commonSituations":"MinIO credentials changed in docker-compose but not in Budibase env; IAM user lacking CreateBucket/PutObject policies; AWS S3 bucket name already taken by another account (can surface as access issues); expired cloud credentials/keys rotated.","solutions":["Verify AWS/MinIO credentials (access key, secret, region/endpoint) configured for the object store are current and correct","Grant the credential's IAM policy permissions: s3:CreateBucket, s3:PutObject, s3:GetObject, s3:DeleteObject, s3:ListBucket on the target bucket/prefix","Pre-create the bucket manually (aws s3 mb / MinIO mc mb) with correct ownership if credentials cannot create buckets","Restart or re-login after any credential rotation; check MinIO container logs for auth failures"],"exampleFix":"// before (IAM policy)\n{ \"Effect\": \"Deny\", \"Action\": \"s3:CreateBucket\", \"Resource\": \"*\" }\n// after\n{ \"Effect\": \"Allow\", \"Action\": [\"s3:CreateBucket\", \"s3:PutObject\", \"s3:GetObject\", \"s3:DeleteObject\", \"s3:ListBucket\"], \"Resource\": [\"arn:aws:s3:::budibase-apps\", \"arn:aws:s3:::budibase-apps/*\"] }","handlingStrategy":"try-catch","validationCode":"async function canAccessBucket(client, bucket) {\n  try {\n    await client.send(new HeadBucketCommand({ Bucket: bucket }))\n    return true\n  } catch (e) {\n    return e?.$metadata?.httpStatusCode !== 403 && e?.$response?.statusCode !== 403\n  }\n}","typeGuard":null,"tryCatchPattern":"try {\n  await createBucketIfNotExists(client, bucketName)\n} catch (err) {\n  if (String(err.message).startsWith(\"Access denied to object store bucket\")) {\n    // do not retry blindly — credentials/permissions must be fixed first\n  }\n}","preventionTips":["Verify object store credentials in env before deployment and after any rotation","Grant the IAM policy CreateBucket plus object read/write/delete on the bucket","Pre-create buckets with the correct owner when credentials lack CreateBucket","Confirm MinIO root/user credentials match between the storage container and Budibase env"],"tags":["aws","s3","permissions","object-store","auth"],"backgroundTag":"access-denied-storage","analyzedSha":"a81a902e9a8fe55b467d106765f6638f12e35c49","analyzedAt":"2026-08-29T01:03:10.972Z","schemaVersion":2},"datasetVersion":"2026-08-29T02:17:18.158Z"}