Comment 2 for bug 1904622

For the sake of pointing out the AWS creds which I think is what you are hinting at with "check permission keys".
As I was in my original bash script, and for testing I am exporting in my shell:
AWS_ACCESS_KEY_ID=$akey
AWS_SECRET_ACCESS_KEY=$sakey
PASSPHRASE=$passphrase

s3cmd seemed to like this without intervention, but I manually made ~/.s3cfg and verified that working as well.

I also created an .aws/credentials file with
[default]
aws_access_key_id = $akey
aws_secret_access_key = $sakey

I then verified that boto3 was seeing this with
ubuntu@duplicity-f:~$ python3
Python 3.8.5 (default, Jul 28 2020, 12:59:40)
[GCC 9.3.0] on linux
Type "help", "copyright", "credits" or "license" for more information.
>>> import boto3
>>> client = boto3.client('s3')
>>> client.list_buckets()
{'ResponseMetadata': {'RequestId': '$responseid', 'HostId': '$hostid', 'HTTPStatusCode': 200, 'HTTPHeaders': {'x-amz-id-2': '$amz-id-2', 'x-amz-request-id': 'amz-request-id',[snip],}}

And this properly returns the buckets in this IAM account, so I assume boto3 is properly able to hit the s3 credentials file. I sanitized some data, hopefully which doesn't nullify the utility.
Attaching the full sanitized response as boto3_demo_working.log

My python is very rusty, I'm more or less bashing my way through verifying all of this so if something would be more effective please let me know.

That said, I am still unable to get past the 403 in the duplicity run.
Attaching full 2>&1 output as duplicity_demo_nonworking.log.
Again, sanitized as much as possible, while still not obfuscating the important parts (hopefully).

And just to provide some clean and clear repro steps:
I am using a fresh focal image in multipass for consistent clean testing.
# apt update; apt dist-upgrade; apt install duplicity python3-boto3

ubuntu@duplicity-f:~$ lsb_release -a ; uname -a ; dpkg -l | grep duplicity ; dpkg -l | grep -i boto
No LSB modules are available.
Distributor ID: Ubuntu
Description: Ubuntu 20.04.1 LTS
Release: 20.04
Codename: focal
Linux duplicity-f 5.4.0-54-generic #60-Ubuntu SMP Fri Nov 6 10:37:59 UTC 2020 x86_64 x86_64 x86_64 GNU/Linux
ii duplicity 0.8.11.1612-1 amd64 encrypted bandwidth-efficient backup
ii python3-boto3 1.9.253-1 all Python interface to Amazon's Web Services - Python 3.x
ii python3-botocore 1.16.19+repack-1ubuntu0.20.04.1 all Low-level, data-driven core of boto 3 (Python 3)

Please let me know what else I may be able to provide.