{"record":{"id":"f314983b2a7f49fd","repo":"anomalyco/sst","slug":"failed-to-put-bucket-policy-for-s-w","errorCode":null,"errorMessage":"failed to put bucket policy for %s: %w","messagePattern":"failed to put bucket policy for (.+?): %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/project/provider/aws.go","lineNumber":522,"sourceCode":"\t\t\t\t\t\t\t\"Bool\": map[string]interface{}{\n\t\t\t\t\t\t\t\t\"aws:SecureTransport\": \"false\",\n\t\t\t\t\t\t\t},\n\t\t\t\t\t\t},\n\t\t\t\t\t},\n\t\t\t\t},\n\t\t\t}\n\n\t\t\tpolicyJSON, err := json.Marshal(policy)\n\t\t\tif err != nil {\n\t\t\t\treturn fmt.Errorf(\"failed to marshal policy for bucket %s: %w\", bucket, err)\n\t\t\t}\n\n\t\t\t_, err = s3Client.PutBucketPolicy(ctx, &s3.PutBucketPolicyInput{\n\t\t\t\tBucket: aws.String(bucket),\n\t\t\t\tPolicy: aws.String(string(policyJSON)),\n\t\t\t})\n\t\t\tif err != nil {\n\t\t\t\treturn fmt.Errorf(\"failed to put bucket policy for %s: %w\", bucket, err)\n\t\t\t}\n\t\t}\n\n\t\treturn nil\n\t},\n\n\t// Step: add appsync events apis for live lambda - we no longer do this\n\tfunc(ctx context.Context, cfg aws.Config, data *AwsBootstrapData) error {\n\t\treturn nil\n\t},\n}\n\ntype AwsHome struct {\n\tprovider *AwsProvider\n\tcompress bool\n}\n\nfunc NewAwsHome(provider *AwsProvider, compress bool) *AwsHome {","sourceCodeStart":504,"sourceCodeEnd":540,"githubUrl":"https://github.com/anomalyco/sst/blob/a0bd20f762883e72a35caccb4896c42ce5b3f707/pkg/project/provider/aws.go#L504-L540","documentation":"The SSL-enforcement step applies a bucket policy Denying non-HTTPS access via `s3:PutBucketPolicy`. If AWS rejects the call, this error wraps it. Common AWS-side rejections are malformed policy, missing `s3:PutBucketPolicy` permission, or a bucket-owner/account mismatch.","triggerScenarios":"Deploy role lacks `s3:PutBucketPolicy`; a `Deny s3:PutBucketPolicy` condition on the bucket itself (policy lock-out); bucket is in a different account/region than configured; Object Ownership/ACL settings interfering in cross-account setups.","commonSituations":"Locked-out buckets after a previously applied bad policy; restricted production IAM; org SCPs restricting bucket policy changes.","solutions":["Check IAM/SCP permissions for `s3:PutBucketPolicy` on the asset/state buckets","If the bucket is policy-locked, remove the blocking policy via root account or an admin role, then re-run `sst deploy`","Verify credentials/region point at the account that owns the buckets"],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":"aws iam simulate-principal-policy --policy-source-arn <deploy-role-arn> --action-names s3:PutBucketPolicy --resource-arns arn:aws:s3:::sst-asset-bucket arn:aws:s3:::sst-state-bucket","typeGuard":null,"tryCatchPattern":"err := sstDeploy(ctx)\nif err != nil && strings.Contains(err.Error(), \"failed to put bucket policy\") {\n    // likely AccessDenied or policy lock-out; inspect bucket policy with an admin role, then retry\n    inspectAndRepairBucketPolicy(\"sst-asset-bucket\")\n    err = sstDeploy(ctx)\n}","preventionTips":["Grant s3:PutBucketPolicy/GetBucketPolicy/DeleteBucketPolicy to the deploy role","Avoid applying bucket-policy lockout Denies on sst-managed buckets","Keep buckets in the same account/region as the deploy config"],"tags":["aws","s3","bucket-policy","ssl"],"backgroundTag":"access-denied-iam","analyzedSha":"a0bd20f762883e72a35caccb4896c42ce5b3f707","analyzedAt":"2026-08-30T11:26:00.383Z","schemaVersion":2},"datasetVersion":"2026-08-30T13:17:10.514Z"}