I have an S3 bucket and an EC2 with a role that access to that bucket. The ec2 can access s3://mybucket/folderA/file1, but can't access s3://mybucket/folderB/file2. I can't seem to figure out why I can access file1 but not file2 from the ec2 instance. When I try to download file2 like this:

aws s3 cp s3://mybucket/folderB/file2 /home/ec2-user/file2

I get this error:

fatal error: An error occurred (403) when calling the HeadObject operation: Forbidden

But I don't get that error when i download file1:

aws s3 cp s3://mybucket/folderA/file1 /home/ec2-user/file1

----EDIT------

I missed the 403 error...so I guess the question is why isn't it seeing the file

----EDIT-----

here is my bucket policy

{
    "Version": "1-1-1",
    "Id": "Policy111111111",
    "Statement": [
        {
            "Sid": "Sxxxxxxx1234",
            "Effect": "Deny",
            "Principal": "*",
            "Action": "s3:GetObject",
            "Resource": [
                "arn:aws:s3:::mybucket",
                "arn:aws:s3:::mybucket/*"
            ],
            "Condition": {
                "StringNotEquals": {
                    "aws:sourceVpc": "vpc-a8xxxxx"
                }
            }
        },
        {
            "Sid": "RequiredEncryptedPutObject",
            "Effect": "Deny",
            "Principal": "*",
            "Action": "s3:PutObject",
            "Resource": "arn:aws:s3:::mybucket/*",
            "Condition": {
                "StringNotEquals": {
                    "s3:x-amz-server-side-encryption": [
                        "AES256",
                        "aws:kms"
                    ]
                }
            }
        }
    ]
}