Access Denied Without Policy Visibility
warningsecurityUpdated Jan 28, 2026
MinIO access denied errors often lack clear indication of which policy rule caused the denial, forcing operators to manually correlate user policies, group memberships, and bucket policies to identify the root cause.
Sources
Technologies:
How to detect:
Detect AccessDenied errors (HTTP 403) in MinIO audit logs where policyEval=DENY or error code is AccessDenied, especially when audit logs show 'No matching statement' or similar policy evaluation failures.
Recommended action:
Enable MinIO audit logging to capture detailed policy evaluation results. Use 'mc admin policy entities' to inspect effective policies for the affected user/service account. Verify ListBucket permission is granted on bucket resource (not just object resources). Check for conflicting bucket policies that override IAM policies.