10

I'm trying to setup an Asset source on S3, but i'm having trouble getting the correct permissions.

This is my current policy file:

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "s3:ListAllMyBuckets"
            ],
            "Resource": [
                "arn:aws:s3:::"
            ]
        },
        {
            "Effect": "Allow",
            "Action": [
                "s3:ListBucket"
            ],
            "Resource": [
                "arn:aws:s3:::bucketname"
            ]
        },
        {
            "Sid": "Stmt1456139254000",
            "Effect": "Allow",
            "Action": [
                "s3:*"
            ],
            "Resource": [
                "arn:aws:s3:::bucketname/*"
            ]
        }
    ]
}

This gives me "Permission denied" when trying to list the buckets.

Improve this question
13

You need to allow to list bucket location. Also, I'm not confident if you'd be able to upload and delete objects from the bucket with that policy.

I'd go with:

{
"Version": "2012-10-17",
"Statement": [
    {
        "Effect": "Allow",
        "Action": [
            "s3:ListAllMyBuckets"
        ],
        "Resource": "*"
    },
    {
        "Effect": "Allow",
        "Action": [
            "s3:GetBucketLocation",
            "s3:ListBucket",
            "s3:PutObject",
            "s3:GetObject",
            "s3:DeleteObject",
            "s3:GetObjectAcl",
            "s3:PutObjectAcl"
        ],
        "Resource": [
            "arn:aws:s3:::bucketname/*"
        ]
    },
    {
        "Effect": "Allow",
        "Action": [
            "s3:GetBucketLocation",
            "s3:ListBucket"
        ],
        "Resource": [
            "arn:aws:s3:::bucketname"
        ]
    }
]
}
Improve this answer
  • This policy is exactly what you need an no more. I experimented with at least 8 different permutations of things like this seeking to grant access to only the minimum that would allow the CraftCMS "Add Asset" UI to render and get the asset source working. ^^ that solution nails it, thanks for sharing. – Joe Goggins May 12 '16 at 5:08
  • 1
    Hi guys. I get an error with this policy ("Missing required field Principal"). I know I need to add "Principal": { "AWS": [ "my-account-num" ] }, but I just don't know where in the policy? – Ian Ebden May 31 '17 at 12:11
  • @IanEbden Try adding the policy directly to a user or to a user group instead of to the bucket itself. – Jameal G May 31 '17 at 17:09
2

I'm no AWS expert but does your iam user have the correct access/secret keys as well?

While you're at it, you might as well grant PutObject, GetObject, and DeleteObject in that policy as well so Craft has access to the objects in it.

See this blog post by Amazon for a good starting point.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.