Permission error reading file attributes when downloading from S3 using OIDC profile

[dfrkp]

When using a cyberduckprofile to connect to AWS S3 using OpenID Connect (OIDC) I get a "Failure to read attributes.." error when attempting to download. Listing and Upload work fine though.

This happens with s3:* privileges granted to the IAM role used through OIDC.

To Reproduce
Steps to reproduce the behavior:

1. Create a cyberduckprofile for OIDC (following the documentation here: https://docs.cyberduck.io/protocols/profiles/aws_oidc/)
2. Open the cyberduckprofile in Cyberduck
3. Login with the OIDC provider
4. Try to download a file

Expected behavior
Download should work.

Desktop (please complete the following information):

• OS: macOS 26
• Cyberduck Version: reproducible from 9.1.3 to 9.3.1

Log Files

2025-12-03 18:42:48,298 [Thread-89] WARN  ch.cyberduck.core.threading.BackgroundCallable - Failure running background task WorkerBackgroundAction{worker=ConcurrentTransferWorker{source=StatelessSessionPool{session=Session{host=Host{protocol=Profile{parent=s3, vendor=s3-sts, description=Cytario - vericura-life-science-services, image=null}, region='null', port=443, hostname='s3.amazonaws.com', credentials=Credentials{user='[email protected]', password='', tokens='TemporaryAccessTokens{accessKeyId='********', secretAccessKey='********', sessionToken='********', expiryInMilliseconds=1764787361000}', oauth='OAuthTokens{accessToken='********', refreshToken='********', idToken='********', expiryInMilliseconds=1764784061169}', identity=null, properties={}}, uuid='f6a578e2-13f8-40ea-a559-1e40cfa2ef76', nickname='null', defaultpath='/vericura-life-science-services/', workdir=null, custom=null, labels=null}, state=open}}, destination=ch.cyberduck.core.pool.SessionPool$DisconnectedSessionPool@4b41587d, pool=java.util.concurrent.ExecutorCompletionService@790ac3e0}}
java.lang.Exception
	at ch.cyberduck.core.threading.BackgroundCallable.<init>(BackgroundCallable.java:38)
	at ch.cyberduck.core.threading.DefaultBackgroundExecutor.execute(DefaultBackgroundExecutor.java:71)
	at ch.cyberduck.core.AbstractController.background(AbstractController.java:72)
	at ch.cyberduck.ui.cocoa.controller.TransferController.add(TransferController.java:531)
	at ch.cyberduck.ui.cocoa.controller.TransferController.start(TransferController.java:627)
	at ch.cyberduck.ui.cocoa.controller.BrowserController.transfer(BrowserController.java:2828)
	at ch.cyberduck.ui.cocoa.controller.BrowserController.transfer(BrowserController.java:2805)
	at ch.cyberduck.ui.cocoa.controller.BrowserController.downloadButtonClicked(BrowserController.java:2719)
	at java.base/jdk.internal.reflect.DirectMethodHandleAccessor.invoke(Unknown Source)
	at java.base/java.lang.reflect.Method.invoke(Unknown Source)
	at org.rococoa.internal.OCInvocationCallbacks.callMethod(OCInvocationCallbacks.java:170)
	at org.rococoa.internal.OCInvocationCallbacks.access$200(OCInvocationCallbacks.java:52)
	at org.rococoa.internal.OCInvocationCallbacks$2.callback(OCInvocationCallbacks.java:82)
	at java.base/jdk.internal.reflect.DirectMethodHandleAccessor.invoke(Unknown Source)
	at java.base/java.lang.reflect.Method.invoke(Unknown Source)
	at com.sun.jna.CallbackReference$DefaultCallbackProxy.invokeCallback(CallbackReference.java:585)
	at com.sun.jna.CallbackReference$DefaultCallbackProxy.callback(CallbackReference.java:613)
	at com.sun.jna.Native.invokeVoid(Native Method)
	at com.sun.jna.Function.invoke(Function.java:418)
	at com.sun.jna.Function.invoke(Function.java:364)
	at com.sun.jna.Function.invoke(Function.java:318)
	at org.rococoa.internal.MsgSendHandler.invoke(MsgSendHandler.java:114)
	at com.sun.jna.Library$Handler.invoke(Library.java:268)
	at jdk.proxy2/jdk.proxy2.$Proxy3.syntheticSendMessage(Unknown Source)
	at org.rococoa.Foundation.send(Foundation.java:211)
	at org.rococoa.Foundation.send(Foundation.java:185)
	at org.rococoa.internal.ObjCObjectInvocationHandler.sendOnThisOrMainThread(ObjCObjectInvocationHandler.java:224)
	at org.rococoa.internal.ObjCObjectInvocationHandler.invokeCocoa(ObjCObjectInvocationHandler.java:191)
	at org.rococoa.internal.ObjCObjectInvocationHandler.invoke(ObjCObjectInvocationHandler.java:150)
	at ch.cyberduck.binding.application.NSApplication$$ByRococoa.run(Unknown Source)
	at ch.cyberduck.ui.cocoa.MainApplication.main(MainApplication.java:71)
Caused by: ch.cyberduck.core.exception.AccessDeniedException: Failure to read attributes of LuCa-7color_Scan1.ome.tif.
	at ch.cyberduck.core.http.HttpResponseExceptionMappingService.map(HttpResponseExceptionMappingService.java:60)
	at ch.cyberduck.core.http.HttpResponseExceptionMappingService.map(HttpResponseExceptionMappingService.java:49)
	at ch.cyberduck.core.s3.S3ExceptionMappingService.map(S3ExceptionMappingService.java:124)
	at ch.cyberduck.core.s3.S3ExceptionMappingService.map(S3ExceptionMappingService.java:45)
	at ch.cyberduck.core.AbstractExceptionMappingService.map(AbstractExceptionMappingService.java:53)
	at ch.cyberduck.core.s3.S3AttributesFinderFeature.find(S3AttributesFinderFeature.java:103)
	at ch.cyberduck.core.vault.registry.VaultRegistryAttributesFeature.find(VaultRegistryAttributesFeature.java:40)
	at ch.cyberduck.core.CachingAttributesFinderFeature.find(CachingAttributesFinderFeature.java:96)
	at ch.cyberduck.core.CachingAttributesFinderFeature.find(CachingAttributesFinderFeature.java:70)
	at ch.cyberduck.core.transfer.download.AbstractDownloadFilter.prepare(AbstractDownloadFilter.java:136)
	at ch.cyberduck.core.worker.AbstractTransferWorker$2.call(AbstractTransferWorker.java:266)
	at ch.cyberduck.core.worker.AbstractTransferWorker$2.call(AbstractTransferWorker.java:244)
	at java.base/java.util.concurrent.FutureTask.run(Unknown Source)
	at java.base/java.util.concurrent.Executors$RunnableAdapter.call(Unknown Source)
	at java.base/java.util.concurrent.FutureTask.run(Unknown Source)
	at java.base/java.util.concurrent.ThreadPoolExecutor.runWorker(Unknown Source)
	at java.base/java.util.concurrent.ThreadPoolExecutor$Worker.run(Unknown Source)
	at ch.cyberduck.core.threading.NamedThreadFactory$1.run(NamedThreadFactory.java:57)
	at java.base/java.lang.Thread.run(Unknown Source)
Caused by: org.apache.http.client.HttpResponseException: status code: 403, reason phrase: Forbidden. Request Error.
	... 17 more
2025-12-03 18:42:48,298 [Thread-89] WARN  ch.cyberduck.core.worker.DefaultExceptionMappingService - Map failure BackgroundException{class=class ch.cyberduck.core.exception.AccessDeniedException, file=Path{path='/vericura-life-science-services/Helix BioSciences/LuCa-7color_Scan1.ome.tif', type=[file]}, message='Failure to read attributes of LuCa-7color_Scan1.ome.tif.', detail='Forbidden. Request Error.', cause='org.apache.http.client.HttpResponseException: status code: 403, reason phrase: Forbidden. Request Error.'}
2025-12-03 18:42:48,298 [Thread-89] INFO  ch.cyberduck.core.threading.SessionBackgroundAction - Run alert callback ch.cyberduck.ui.cocoa.callback.PromptAlertCallback@4962a6ff for failure BackgroundException{class=class ch.cyberduck.core.exception.AccessDeniedException, file=Path{path='/vericura-life-science-services/Helix BioSciences/LuCa-7color_Scan1.ome.tif', type=[file]}, message='Failure to read attributes of LuCa-7color_Scan1.ome.tif.', detail='Forbidden. Request Error.', cause='org.apache.http.client.HttpResponseException: status code: 403, reason phrase: Forbidden. Request Error.'}

Additional context
I can provide access to a testing environment if that's helpful.

[dkocher]

Apparently there is a permission error with the 403 error returned. Please include the HTTP request and response logged (prefixed with ch.cyberduck.transcript) in cyberduck.log or in Terminal.app

log stream --predicate '(process == "Cyberduck") && (category == "transcript")' --level info

[dfrkp]

Good Morning and thank you @dkocher for the quick response!

I debugged this further today and identified a weird behavior in our bucket policy to be the reason. Sorry for raising the bug ticket prematurely.