Consul snapshot agent backup file to aws s3 error

Currently, we setup a consul snapshot agent to backup our consul data.
But we found following error message:
```
Jul 10 16:35:25 ip-10-211-178-16 consul[4284]: Lock Key: "consul-snapshot/lock"
Jul 10 16:35:25 ip-10-211-178-16 consul[4284]: Max Failures: 3
Jul 10 16:35:25 ip-10-211-178-16 consul[4284]: Snapshot Storage: Amazon S3 -> Region: "xx-xxxxx-x" Bucket: "security-vault-backup" Key Prefix: "consul
Jul 10 16:35:25 ip-10-211-178-16 consul[4284]: ==> Log data will now stream in as it occurs:
Jul 10 16:35:25 ip-10-211-178-16 consul[4284]: 2018/07/10 16:35:25 [INFO] Waiting to obtain leadership...
Jul 10 16:35:25 ip-10-211-178-16 consul[4284]: 2018/07/10 16:35:25 [INFO] Obtained leadership
Jul 10 16:35:25 ip-10-211-178-16 consul[4284]: 2018/07/10 16:35:25 [DEBUG] Taking a snapshot...
Jul 10 16:35:26 ip-10-211-178-16 consul[4284]: 2018/07/10 16:35:26 [INFO] Saved snapshot with id 1531208125988786033
Jul 10 16:35:26 ip-10-211-178-16 consul[4284]: 2018/07/10 16:35:26 [ERR] Snapshot failed (will retry at next interval): AccessDenied: Access Denied
Jul 10 16:35:26 ip-10-211-178-16 consul[4284]: status code: 403, request id: xxxxxxxxxx
```
Our target S3 Bucket Permissions is:
```
s3:ListBucket on arn:aws:s3:::mybucket
s3:GetObject on arn:aws:s3:::mybucket/path/to/my/key
s3:PutObject on arn:aws:s3:::mybucket/path/to/my/key
```

**But we can see the snapshot files have uploaded to aws s3.
Why I still get error message?**

Maybe our target S3 Bucket Permissions not enough?
Should we assign some other s3 permissions to our target S3 Bucket?