Just checking the permissions of the containing folder will not be enough: you'll need to check the permissions of all the higher-level folders, up to the root directory. For example, like this:
# ls -ld /root/.composer/vendor/drush/drush/drush \
You may find that the
/root directory has permissions 700 (or
drwx------), and that is blocking the
web3 user from proceeding any further on that path. It is not a good idea to let other users access the home directory of the
root user, although you technically could give it permissions 711 (
drwx--x--x) if you consider it absolutely necessary.
But it is possible that this won't help you either...
You're using CentOS 7, which has SELinux enabled by default.
RHEL/CentOS has a default SELinux configuration that usually has a pretty negligible effect on regular user accounts, but it can place some strict limits on system services - like a web server, for example.
Under SELinux, it is possible to restrict a process and all of its descendants from certain actions - independently from traditional Unix-style user/group/permissions system. Those restrictions can be configured to automatically "latch on" when certain binaries are executed, for certain system users, and on a multitude of other conditions.
One of the default SELinux restrictions for a webserver is that access to anything outside specifically enabled directories like
/var/www is blocked, unless specifically enabled using a SELinux boolean, a kind of switchable option in SELinux ruleset. I think this might be another thing stopping the web3 user from accessing the Drush application.
If you want a web server (or any of its descendants, like a PHP interpreter) to access any content that is not under
/var/www and is created by other users, you'll need to run this command:
# setsebool -P httpd_read_user_content 1
On RHEL/CentOS, each system service has an additional man page, named like
<service name>_selinux, that contains information on SELinux restrictions and booleans for that specific service. Those man pages come in a RPM package named
selinux-policy-doc: here's more information about that package. If you're using a system with SELinux enabled, you really should read those man pages for all the services you're planning to run: they make dealing with SELinux just so much easier.
Of course, you may find on the internet a lot of suggestions on how to disable SELinux, but if you are planning to run a secure server, that might not be the best option.