AccessDenied during oclif promote

[TheOrangePuff]

Do you want to request a feature or report a bug?

Bug / question?

What is the current behavior?

Running oclif promote results in Access Denied.

$ AWS_ACCESS_KEY_ID="-------" AWS_SECRET_ACCESS_KEY="-------" oclif promote --deb --channel stable --version 0.0.0 --sha 56dfc10

Promoting buildmanifests & unversioned tarballs to stable
oclif: s3:copyObject from s3://example-pkg/versions/0.0.0/56dfc10/liftoff-v0.0.0-56dfc10-linux-x64-buildmanifest to s3://example-pkg/channels/stable/liftoff-linux-x64-buildmanifest
oclif: s3:copyObject from s3://example-pkg/versions/0.0.0/56dfc10/liftoff-v0.0.0-56dfc10-linux-x64.tar.gz to s3://example-pkg/channels/stable/liftoff-linux-x64.tar.gz
oclif: s3:copyObject from s3://example-pkg/versions/0.0.0/56dfc10/liftoff-v0.0.0-56dfc10-linux-arm-buildmanifest to s3://example-pkg/channels/stable/liftoff-linux-arm-buildmanifest
oclif: s3:copyObject from s3://example-pkg/versions/0.0.0/56dfc10/liftoff-v0.0.0-56dfc10-linux-arm.tar.gz to s3://example-pkg/channels/stable/liftoff-linux-arm.tar.gz
oclif: s3:copyObject from s3://example-pkg/versions/0.0.0/56dfc10/liftoff-v0.0.0-56dfc10-win32-x64-buildmanifest to s3://example-pkg/channels/stable/liftoff-win32-x64-buildmanifest
oclif: s3:copyObject from s3://example-pkg/versions/0.0.0/56dfc10/liftoff-v0.0.0-56dfc10-win32-x64.tar.gz to s3://example-pkg/channels/stable/liftoff-win32-x64.tar.gz
oclif: s3:copyObject from s3://example-pkg/versions/0.0.0/56dfc10/liftoff-v0.0.0-56dfc10-win32-x86-buildmanifest to s3://example-pkg/channels/stable/liftoff-win32-x86-buildmanifest
oclif: s3:copyObject from s3://example-pkg/versions/0.0.0/56dfc10/liftoff-v0.0.0-56dfc10-win32-x86.tar.gz to s3://example-pkg/channels/stable/liftoff-win32-x86.tar.gz
oclif: s3:copyObject from s3://example-pkg/versions/0.0.0/56dfc10/liftoff-v0.0.0-56dfc10-darwin-x64-buildmanifest to s3://example-pkg/channels/stable/liftoff-darwin-x64-buildmanifest
oclif: s3:copyObject from s3://example-pkg/versions/0.0.0/56dfc10/liftoff-v0.0.0-56dfc10-darwin-x64.tar.gz to s3://example-pkg/channels/stable/liftoff-darwin-x64.tar.gz
oclif: s3:copyObject from s3://example-pkg/versions/0.0.0/56dfc10/liftoff-v0.0.0-56dfc10-darwin-arm64-buildmanifest to s3://example-pkg/channels/stable/liftoff-darwin-arm64-buildmanifest
oclif: s3:copyObject from s3://example-pkg/versions/0.0.0/56dfc10/liftoff-v0.0.0-56dfc10-darwin-arm64.tar.gz to s3://example-pkg/channels/stable/liftoff-darwin-arm64.tar.gz
Promoting debian artifacts to stable
oclif: s3:copyObject from s3://example-pkg/versions/0.0.0/56dfc10/apt/liftoff_0.0.0.56dfc10-1_amd64.deb to s3://example-pkg/channels/stable/apt/liftoff_0.0.0.56dfc10-1_amd64.deb
oclif: s3:copyObject from s3://example-pkg/versions/0.0.0/56dfc10/apt/liftoff_0.0.0.56dfc10-1_amd64.deb to s3://example-pkg/channels/stable/apt/liftoff_0.0.0.56dfc10-1_amd64.deb
oclif: s3:copyObject from s3://example-pkg/versions/0.0.0/56dfc10/apt/liftoff_0.0.0.56dfc10-1_i386.deb to s3://example-pkg/channels/stable/apt/liftoff_0.0.0.56dfc10-1_i386.deb
oclif: s3:copyObject from s3://example-pkg/versions/0.0.0/56dfc10/apt/liftoff_0.0.0.56dfc10-1_i386.deb to s3://example-pkg/channels/stable/apt/liftoff_0.0.0.56dfc10-1_i386.deb
oclif: s3:copyObject from s3://example-pkg/versions/0.0.0/56dfc10/apt/Packages.gz to s3://example-pkg/channels/stable/apt/Packages.gz
oclif: s3:copyObject from s3://example-pkg/versions/0.0.0/56dfc10/apt/Packages.gz to s3://example-pkg/channels/stable/apt/Packages.gz
oclif: s3:copyObject from s3://example-pkg/versions/0.0.0/56dfc10/apt/Packages.xz to s3://example-pkg/channels/stable/apt/Packages.xz
oclif: s3:copyObject from s3://example-pkg/versions/0.0.0/56dfc10/apt/Packages.xz to s3://example-pkg/channels/stable/apt/Packages.xz
oclif: s3:copyObject from s3://example-pkg/versions/0.0.0/56dfc10/apt/Packages.bz2 to s3://example-pkg/channels/stable/apt/Packages.bz2
oclif: s3:copyObject from s3://example-pkg/versions/0.0.0/56dfc10/apt/Packages.bz2 to s3://example-pkg/channels/stable/apt/Packages.bz2
oclif: s3:copyObject from s3://example-pkg/versions/0.0.0/56dfc10/apt/Release to s3://example-pkg/channels/stable/apt/Release
oclif: s3:copyObject from s3://example-pkg/versions/0.0.0/56dfc10/apt/Release to s3://example-pkg/channels/stable/apt/Release
oclif: s3:copyObject from s3://example-pkg/versions/0.0.0/56dfc10/apt/InRelease to s3://example-pkg/channels/stable/apt/InRelease
oclif: s3:copyObject from s3://example-pkg/versions/0.0.0/56dfc10/apt/InRelease to s3://example-pkg/channels/stable/apt/InRelease
oclif: s3:copyObject from s3://example-pkg/versions/0.0.0/56dfc10/apt/Release.gpg to s3://example-pkg/channels/stable/apt/Release.gpg
oclif: s3:copyObject from s3://example-pkg/versions/0.0.0/56dfc10/apt/Release.gpg to s3://example-pkg/channels/stable/apt/Release.gpg
(node:179520) NOTE: We are formalizing our plans to enter AWS SDK for JavaScript (v2) into maintenance mode in 2023.

Please migrate your code to use AWS SDK for JavaScript (v3).
For more information, check the migration guide at https://a.co/7PzMCcy
(Use `node --trace-warnings ...` to show where the warning was created)
    AccessDenied: Access Denied
    Code: AccessDenied

AWS user permissions are configured as follows:

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "s3:DeleteObject",
                "s3:GetObject",
                "s3:PutObject",
                "s3:GetObjectAcl",
                "s3:PutObjectAcl"
            ],
            "Resource": [
                "arn:aws:s3:::example-pkg/*",
                "arn:aws:s3:::example-pkg"
            ]
        }
    ]
}

Sometimes a few files are copied successfully but not all of them (the error still displays). Sometimes nothing happens and it just errors.

What is the expected behavior?

Using oclif/3.7.2 linux-x64 node-v18.12.1

Expected behaviour is to copy all files from versions/0.0.0/56dfc10/apt into channels/stable/apt.

Note that running oclif upload deb works as expected. I don't believe I'm missing permissions as I've tried * * to test and still had no luck. (Although as a side note, are the required permissions documented anywhere?)