> For the complete documentation index, see [llms.txt](https://karansingh.gitbook.io/tutorialsdojo-wrong-answers-aws-sec-spec/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://karansingh.gitbook.io/tutorialsdojo-wrong-answers-aws-sec-spec/access-denied-error-when-uploading-an-encrypted-large-file-to-s3-bucket.md).

# Access Denied error when uploading an encrypted large file to S3 bucket

* If you are getting an **`Access Denied` error when trying to upload a large file to your S3 bucket with an upload request that includes an KMS key:**
  * Confirm that you have the **permission to perform `kms:Decrypt` actions on the KMS key that you're using** to encrypt the object.<br>
* **`kms:Decrypt` is only one of the actions that you must have permissions to** when you upload or download an S3 object encrypted with an KMS key. You **must also have permissions to `kms:Encrypt`, `kms:ReEncrypt*`, `kms:GenerateDataKey*`, and `kms:DescribeKey` actions**.<br>
* The AWS CLI (aws s3 commands), AWS SDKs, and many third-party programs **automatically perform a multipart upload when the file is large**. **To perform a multipart upload with encryption using an KMS key, the requester must have permission to the `kms:Decrypt`** action on the key. This permission is **required because S3 must decrypt and read data from the encrypted file parts before it completes the multipart upload**.