Correct IAM settings for Amazon S3 bucket

Question

I'm trying to setup an Asset source on S3, but i'm having trouble getting the correct permissions.

This is my current policy file:

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "s3:ListAllMyBuckets"
            ],
            "Resource": [
                "arn:aws:s3:::"
            ]
        },
        {
            "Effect": "Allow",
            "Action": [
                "s3:ListBucket"
            ],
            "Resource": [
                "arn:aws:s3:::bucketname"
            ]
        },
        {
            "Sid": "Stmt1456139254000",
            "Effect": "Allow",
            "Action": [
                "s3:*"
            ],
            "Resource": [
                "arn:aws:s3:::bucketname/*"
            ]
        }
    ]
}

This gives me "Permission denied" when trying to list the buckets.

Answer 1

You need to allow to list bucket location. Also, I'm not confident if you'd be able to upload and delete objects from the bucket with that policy.

I'd go with:

{
"Version": "2012-10-17",
"Statement": [
    {
        "Effect": "Allow",
        "Action": [
            "s3:ListAllMyBuckets"
        ],
        "Resource": "*"
    },
    {
        "Effect": "Allow",
        "Action": [
            "s3:GetBucketLocation",
            "s3:ListBucket",
            "s3:PutObject",
            "s3:GetObject",
            "s3:DeleteObject",
            "s3:GetObjectAcl",
            "s3:PutObjectAcl"
        ],
        "Resource": [
            "arn:aws:s3:::bucketname/*"
        ]
    },
    {
        "Effect": "Allow",
        "Action": [
            "s3:GetBucketLocation",
            "s3:ListBucket"
        ],
        "Resource": [
            "arn:aws:s3:::bucketname"
        ]
    }
]
}

Answer 2

I'm no AWS expert but does your iam user have the correct access/secret keys as well?

While you're at it, you might as well grant PutObject, GetObject, and DeleteObject in that policy as well so Craft has access to the objects in it.

See this blog post by Amazon for a good starting point.