copy from s3 to gs bucket gives 403

Doing a recursive copy fails:

```bash
gsutil cp -r s3://secret-bucket/some_key/ gs://secret-elsewhere/destination/
```

gsutil version: 4.28

Google Cloud SDK 180.0.1
app-engine-python 1.9.63
beta 2017.09.15
bq 2.0.27
core 2017.11.20
gsutil 4.28

EDIT: actual error
```log
AccessDeniedException: 403 AccessDenied

AccessDeniedAccess Deniedsecretsecret
```