Access Denied for ListBuckets/GetBuckets on S3-Compatible Repositories
| KB ID: | 4935 |
| Product: | Veeam Backup & Replication | 12 | 12.1 | 12.2 | 12.3 | 12.3.1 | 12.3.2 | 13 | 13.1 |
| Published: | 2026-10-06 |
| Last Modified: | 2026-10-06 |
Oops! Something went wrong.
Please, try again later.
Challenge
When adding an S3-compatible object storage repository to Veeam Backup & Replication, or during regular use of an existing one, Access Denied events related to a ListBuckets/GetBuckets operation may appear in the object storage system's access logs.
- These issues occur even though the bucket name is explicitly specified at the Bucket step of the Object Repository setting, which should eliminate the need to specify the
ListAllMyBuckets(s3:ListBuckets) permission. - These events are not reflected in Veeam Backup & Replication logs, including extended/verbose logging.
Cause
Veeam Backup & Replication issues a ListBuckets/GetBuckets call in several code paths related to S3-compatible object storage repositories, regardless of whether the bucket name has been explicitly specified. This call is expected to fail when the ListAllMyBuckets permission is not granted, and the resulting failure is intentionally not surfaced to the user, since this permission is not required for normal operation.
As a result, the object storage system logs an Access Denied event for this call, even though the repository and its operations continue to function correctly.
Solution
This behavior has been confirmed as a product issue and will be addressed in a future release of Veeam Backup & Replication.
Until a fix is available, consider the following options:
Option 1: Ignore the Access Denied Events
No action is required. The Access Denied events related to ListBuckets/GetBuckets can be safely ignored, as they do not affect the object storage repository or backup and restore operations.
Option 2: Grant the ListAllMyBuckets Permission
If the object storage system's logging or monitoring configuration requires eliminating these events entirely (for example, due to alerting rules on Access Denied events), grant the ListAllMyBuckets (s3:ListBuckets) permission to the access key or IAM policy used for the object storage repository.
If this KB article did not resolve your issue or you need further assistance with Veeam software, please create a Veeam Support Case.
To submit feedback regarding this article, please click this link: Send Article Feedback
To report a typo on this page, highlight the typo with your mouse and press CTRL + Enter.
Spelling error in text
Thank you!
Your feedback has been received and will be reviewed.
KB Feedback/Suggestion
This form is only for KB Feedback/Suggestions, if you need help with the software open a support case
Thank you!
Your feedback has been received and will be reviewed.
Oops! Something went wrong.
Please, try again later.