diff --git a/src/Command/Remote/AliasesDownloadCommand.php b/src/Command/Remote/AliasesDownloadCommand.php
index 4f9ff0cab..7579e8895 100644
--- a/src/Command/Remote/AliasesDownloadCommand.php
+++ b/src/Command/Remote/AliasesDownloadCommand.php
@@ -130,7 +130,13 @@ protected function downloadDrush9Aliases(InputInterface $input, string $aliasVer
         $drushFiles[] = $baseDir . '/' . $file->getFileName();
       }
     }
-    $archive->extractTo($drushAliasesDir, $drushFiles, TRUE);
+    try {
+      // Throws warnings on permissions errors.
+      @$archive->extractTo($drushAliasesDir, $drushFiles, TRUE);
+    }
+    catch (\Exception) {
+      throw new AcquiaCliException('Could not extract aliases to {destination}', ['destination' => $drushAliasesDir]);
+    }
   }
 
   protected function downloadDrush8Aliases(string $aliasVersion, string $drushArchiveTempFilepath, string $drushAliasesDir): void {
diff --git a/src/EventListener/ExceptionListener.php b/src/EventListener/ExceptionListener.php
index d6368a296..ef0406461 100644
--- a/src/EventListener/ExceptionListener.php
+++ b/src/EventListener/ExceptionListener.php
@@ -67,6 +67,9 @@ public function onConsoleError(ConsoleErrorEvent $event): void {
         case 'This machine is not yet authenticated with Site Factory.':
           $this->helpMessages[] = 'Run `acli auth:acsf-login` to re-authenticate with Site Factory.';
           break;
+        case 'Could not extract aliases to {destination}':
+          $this->helpMessages[] = 'Check that you have write access to the directory';
+          break;
         case 'Invalid key in datastore at {filepath}':
           $this->helpMessages[] = 'Delete the datastore and run this command again.';
           break;
diff --git a/tests/phpunit/src/Commands/Remote/AliasesDownloadCommandTest.php b/tests/phpunit/src/Commands/Remote/AliasesDownloadCommandTest.php
index d6760ae9d..78eb58c9f 100644
--- a/tests/phpunit/src/Commands/Remote/AliasesDownloadCommandTest.php
+++ b/tests/phpunit/src/Commands/Remote/AliasesDownloadCommandTest.php
@@ -6,6 +6,7 @@
 
 use Acquia\Cli\Command\CommandBase;
 use Acquia\Cli\Command\Remote\AliasesDownloadCommand;
+use Acquia\Cli\Exception\AcquiaCliException;
 use Acquia\Cli\Tests\CommandTestBase;
 use GuzzleHttp\Psr7\Utils;
 use Phar;
@@ -82,7 +83,29 @@ public function testRemoteAliasesDownloadCommand(array $inputs, array $args, str
     $this->assertFileDoesNotExist($drushArchiveFilepath);
     $this->assertFileExists($destinationDir);
     $this->assertStringContainsString('Cloud Platform Drush aliases installed into ' . $destinationDir, $output);
+  }
+
+  /**
+   * @requires OS linux|darwin
+   */
+  public function testRemoteAliasesDownloadFailed(): void {
+    $drushAliasesFixture = Path::canonicalize(__DIR__ . '/../../../../fixtures/drush-aliases');
+    $drushAliasesTarballFixtureFilepath = tempnam(sys_get_temp_dir(), 'AcquiaDrushAliases');
+    $archiveFixture = new PharData($drushAliasesTarballFixtureFilepath . '.tar');
+    $archiveFixture->buildFromDirectory($drushAliasesFixture);
+    $archiveFixture->compress(Phar::GZ);
+
+    $stream = Utils::streamFor(file_get_contents($drushAliasesTarballFixtureFilepath . '.tar.gz'));
+    $this->clientProphecy->addQuery('version', '9');
+    $this->clientProphecy->stream('get', '/account/drush-aliases/download')->willReturn($stream);
 
+    $destinationDir = Path::join($this->acliRepoRoot, 'drush');
+    $sitesDir = Path::join($destinationDir, 'sites');
+    mkdir($sitesDir, 0777, TRUE);
+    chmod($sitesDir, 000);
+    $this->expectException(AcquiaCliException::class);
+    $this->expectExceptionMessage("Could not extract aliases to $destinationDir");
+    $this->executeCommand(['--all' => TRUE, '--destination-dir' => $destinationDir], ['9']);
   }
 
 }
diff --git a/tests/phpunit/src/Misc/ExceptionListenerTest.php b/tests/phpunit/src/Misc/ExceptionListenerTest.php
index bebe30803..8d87f7519 100644
--- a/tests/phpunit/src/Misc/ExceptionListenerTest.php
+++ b/tests/phpunit/src/Misc/ExceptionListenerTest.php
@@ -91,6 +91,10 @@ public function providerTestHelp(): array {
         new AcquiaCliException('This machine is not yet authenticated with Site Factory.'),
         'Run `acli auth:acsf-login` to re-authenticate with Site Factory.',
       ],
+      [
+        new AcquiaCliException('Could not extract aliases to {destination}'),
+        'Check that you have write access to the directory',
+      ],
       [
         new AcquiaCliException('Invalid key in datastore at {filepath}'),
         'Delete the datastore and run this command again.',