Tencent Cloud Authorized Partner Tencent Cloud COS File Upload 403 AccessDenied: CAM Policy Checks

If you are seeing 403 AccessDenied when uploading files to Tencent Cloud COS, the fastest mistake is to keep retrying the same SDK code. In real cases, the problem is often not the upload API itself, but one of these four layers:

• CAM permission mismatch — the sub-account or STS token does not have the right COS action or bucket scope.
• Bucket policy or ACL conflict — an explicit deny overrides your allow policy.
• Account status issue — KYC not finished, payment method not verified, or account under risk control review.
• Region / credential / expiration problem — wrong bucket region, expired token, or renewals overdue.

For users who are buying or operating a Tencent Cloud account, the practical question is not “what is CAM?” but “what exactly must be true before upload starts working?” The sections below focus on that.

Tencent Cloud Authorized Partner 1) What users usually mean by “403 AccessDenied” in COS upload

In Tencent COS, a 403 during upload usually means the request reached COS, but COS refused it. That is different from network errors, DNS issues, or timeouts.

In practice, if the error body contains AccessDenied plus a request ID, keep the request ID. It is the fastest way to correlate the failure with CAM logs, COS audit events, or support tickets.

2) The 5-minute checklist before you touch the code

1. Confirm the bucket region. Uploading to the wrong region often looks like a permission issue when it is actually an endpoint mismatch.
2. Check which identity is being used. Root account, sub-account, RAM-like role, or STS temporary credentials each behave differently.
3. Look for explicit deny. In CAM, one deny statement can override many allow statements.
4. Verify whether the object path is restricted. A policy may allow /public/* but deny /private/*.
5. Inspect account status. If the account is new, unverified, unpaid, or under review, a normal-looking API call may still fail.

This checklist saves more time than changing SDK versions. I have seen teams spend half a day debugging signatures when the real issue was an enterprise account still waiting for KYC approval.

3) CAM policy checks that actually matter for COS uploads

For upload operations, the key question is not “does the user have COS access?” but “does the identity have the exact action on the exact bucket/object path?”

Actions commonly needed for file upload

• cos:PutObject — single object upload
• cos:PostObject — browser-based upload scenarios
• cos:InitiateMultipartUpload
• cos:UploadPart
• cos:CompleteMultipartUpload
• cos:AbortMultipartUpload — useful for cleanup, sometimes required by SDK workflows

If you are using multipart upload and only granted PutObject, the console may work for small files but large files fail with 403 or a permission-related error during part upload.

A practical minimal policy example

Below is a compact example. Replace the region, bucket name, and account ID with your own values.

{
  "version": "2.0",
  "statement": [
    {
      "effect": "allow",
      "action": [
        "cos:PutObject",
        "cos:PostObject",
        "cos:InitiateMultipartUpload",
        "cos:UploadPart",
        "cos:CompleteMultipartUpload",
        "cos:AbortMultipartUpload"
      ],
      "resource": [
        "qcs::cos:ap-guangzhou:uid/1250000000:mybucket-1250000000/*"
      ]
    }
  ]
}

Tencent Cloud Authorized Partner What usually goes wrong in real accounts:

• Wrong bucket resource: the policy points to another bucket name or another UID.
• Wrong region: the bucket exists in Singapore, but the policy references Guangzhou.
• Prefix too narrow: only one folder is allowed, while the app uploads elsewhere.
• Deny in another policy: a higher-level policy blocks the action even if this one allows it.

Don’t forget policy inheritance and explicit deny

In real deployments, one person often creates an “allow” policy while another team later adds a security control with “deny” conditions such as source IP, time window, or MFA requirement. When that happens, the final result is still 403.

That is why the practical check is:

1. Identity policy
2. Tencent Cloud Authorized Partner Role policy / STS policy
3. Bucket policy
4. Any deny condition from security controls

4) When the 403 is not a CAM problem at all

Many users search “COS upload 403” after buying a cloud account and assume the permission is broken. In reality, the account itself may not be fully usable yet.

Account purchase and activation issues

If you bought or registered a Tencent Cloud international account recently, check whether the following are complete:

• Email and mobile verification finished
• Identity verification (KYC) approved
• Billing profile completed
• Payment method verified
• No pending risk control review

A common situation: the console lets you create a bucket, but upload fails later because the account is still under activation limitations. This is especially common with newly registered accounts, cross-border accounts, or accounts opened with corporate documents that are still being reviewed.

Risk control can look like a permission issue

When Tencent Cloud detects unusual registration, login, or billing behavior, it may place the account into a review state. You may still be able to log in, but some actions become restricted:

• high-frequency API calls blocked
• new IAM/CAM policy changes delayed
• uploads from unfamiliar IPs challenged or denied
• temporary suspension of object operations

Typical triggers include:

• using a VPN or proxy from a high-risk region during signup
• rapidly creating and deleting users, policies, or buckets
• payment method and account region not matching well
• multiple failed login or verification attempts

If you are seeing 403 on a brand-new account, always ask: Is this truly a CAM problem, or is the account still not fully trusted by the platform?

5) KYC and enterprise verification: what usually blocks uploads indirectly

Identity verification does not directly create COS permissions, but in practice it determines whether the account can be funded, renewed, or cleared for normal usage.

Personal account

• Usually easier to activate
• Often faster for small projects
• Can still face region or payment limitations
• May be harder to use for team-based production workloads

Enterprise account

• Tencent Cloud Authorized Partner Requires business registration documents
• Often needs matching legal entity and payment details
• Can take longer to pass verification
• Better suited when multiple users need access control and billing oversight

Failure patterns I see often:

• company name on the payment card does not match the registered legal entity
• business license scanned copy is blurred or expired
• English and local-language names are inconsistent across documents
• address or phone number mismatches trigger manual review

If your upload issue started right after a new KYC submission, don’t keep changing policies. Check whether the account is pending verification or under manual review.

6) Payment methods, renewals, and why they matter for COS uploads

Even though COS is a storage service, billing status affects service continuity. A lot of users only notice the problem when uploads begin failing.

For teams that need COS uploads to work continuously, the real issue is often not the upload permission but the renewal path. If the account runs into overdue balance, frozen credit line, or failed card renewals, the service may degrade or stop accepting operations depending on account status and grace rules.

Practical advice:

• set billing alerts before the balance gets low
• make sure the payment method can handle recurring charges
• don’t wait for the last day of renewal if your business depends on uploads
• for enterprise setups, keep a backup card or approved billing route

7) Real-world failure scenarios and how to fix them

Tencent Cloud Authorized Partner Scenario A: Console upload works, SDK upload fails

This usually means the console user has broad permissions, but the SDK is using a sub-account or STS token with limited scope.

Fix: compare the identity used by the console session versus the SDK credentials. Confirm the policy includes all multipart actions if the file is large.

Scenario B: Upload works for one folder, but not another

This is almost always a prefix resource problem or a bucket policy deny.

Fix: check whether the CAM resource ends with the correct folder path, and whether the bucket policy explicitly denies other prefixes.

Scenario C: New account, fresh KYC, immediate 403

Tencent Cloud Authorized Partner If the account was just created or verified, the restriction may be operational, not technical.

Fix: confirm verification status, billing activation, and any review notifications. If there is a risk review, policy changes alone won’t solve it.

Scenario D: STS temporary credentials expire mid-upload

Large files and poor network conditions can make a token expire before multipart upload finishes.

Fix: extend token validity, refresh credentials earlier, or reduce upload duration by using chunked upload with retry logic.

Scenario E: Upload fails after a payment card change

Sometimes the upload itself is fine, but the account enters a billing verification state after the card is replaced or re-authorized.

Fix: check whether renewal or verification is pending; wait for billing review to complete before retesting permissions.

8) Cost comparison: what matters when choosing the account and region

When users compare Tencent COS with AWS S3 or Azure Blob, they often focus only on storage price. That is incomplete. For real uploads, the cost difference comes from four items:

• Storage price in the selected region
• Upload request cost for PUT or multipart operations
• Outbound traffic cost if files are later downloaded
• Billing and renewal friction caused by payment method and account review

If you are choosing an account for production uploads, the cheapest storage price is not always the lowest total cost. A slightly cheaper region can become expensive if payment fails, KYC gets delayed, or policy reviews interrupt uploads.

9) What to do if you are buying a Tencent Cloud account for COS use

From an operational point of view, the safest approach is to buy or register the account through the official channel with documents that match your real operating entity.

Practical buying checklist:

• Use the correct legal entity name from day one
• Prepare KYC documents before creating production buckets
• Choose a payment method that supports recurring billing
• Confirm the account can pass verification in your target region
• Avoid shared or resold accounts; they often fail later when CAM, billing, or compliance checks start

Third-party account purchases are risky for COS workloads because the moment you need a policy change, a billing appeal, or a compliance review, the original owner may not be able to help. For storage workflows, that usually becomes a downtime problem, not just an admin problem.

10) FAQ: the questions people ask most when fixing COS 403

Can I upload to COS if the account has not finished KYC?

Sometimes partially, but do not rely on it for production. Unverified or under-review accounts can work one day and fail the next, especially after policy edits or billing events.

Why does 403 happen even when the policy says “Allow”?

Because another policy may deny the same action, or the resource scope is wrong. In CAM, “Allow” is not enough if there is an explicit deny elsewhere.

Do I need root account permission to upload files?

No. In production, the better pattern is to use a sub-account or STS token with only the required COS actions. If the sub-account works, keep root access out of the upload path.

Why did uploads stop after renewal or billing changes?

Billing status changes can trigger review or grace-state behavior. Check whether the payment method failed, the balance is overdue, or the account entered a compliance hold.

Why does small-file upload work but large-file upload fails?

Large files usually require multipart permissions. Missing InitiateMultipartUpload, UploadPart, or CompleteMultipartUpload is a common cause.

Tencent Cloud Authorized Partner How long after policy changes should I retry?

Usually changes are quick, but if the account is under review, policy updates won’t help. If the change was just made, wait a short time, then retest using a fresh credential or new login session.

Tencent Cloud Authorized Partner What is the best first step when support asks for logs?

Provide the request ID, upload time, bucket region, identity used, and the exact credential type. Without that, support can only guess whether it was CAM, STS, or account-level restriction.

11) Practical fix order that saves time

1. Confirm the bucket region and endpoint.
2. Confirm the exact identity used by the upload.
3. Tencent Cloud Authorized Partner Check CAM action permissions for single-part or multipart upload.
4. Check bucket policy, explicit deny rules, and prefix restrictions.
5. Verify token validity if using STS.
6. Check account KYC, billing, renewal, and review status.
7. Retry after clearing browser/session cache or regenerating credentials.

This sequence matches real-world failure rates. In most environments, the actual problem is found in the first four steps. In newly created or newly purchased accounts, the last two steps matter more than users expect.

12) What usually fixes the issue fastest

If you want the shortest path to recovery, do this:

• Use the request ID to confirm it is truly a COS permission denial.
• Switch to a known-good sub-account with a minimal COS upload policy.
• Test one small file in the correct region.
• If that still fails, check account verification, payment, and review status before changing code again.

That approach avoids the most common trap: spending hours editing CAM policies while the account is still blocked at the billing or compliance layer.

If your COS upload is failing right after account purchase, KYC submission, renewal, or a billing change, the real question is not just “what permission is missing?” but “is the account fully cleared to operate?” In Tencent Cloud, those two answers are often different.