1

I have created an s3 bucket in aws and added the correct permissions and user group etc. I have added the below policy:

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "VisualEditor0",
            "Effect": "Allow",
            "Action": [
                "s3:PutObject",
                "s3:GetObjectAcl",
                "s3:GetObject",
                "s3:ListAllMyBuckets",
                "s3:ListBucket",
                "s3:DeleteObject",
                "s3:GetBucketLocation",
                "s3:PutObjectAcl"
            ],
            "Resource": "*"
        },
        {
            "Sid": "VisualEditor1",
            "Effect": "Allow",
            "Action": [
                "s3:ListBucket",
                "s3:GetBucketLocation"
            ],
            "Resource": "arn:aws:s3:::bucketname"
        }
    ]
}

I uploaded the assets from a local folder via ftp to the bucket using transmit ftp client which was fine. I have then set the bucket up on craft cms as an asset source. I can upload files to s3 via the cms fine with no issues and view the image fine but when I try to access an image on the front end that was uploaded via the ftp I get access denied error 403:

<Error>
<Code>AccessDenied</Code>
<Message>Access Denied</Message>
<RequestId>96E15AB155C47209</RequestId>
<HostId>
our-hist-id-here
</HostId>
</Error>

edit here

So after some research I found out that you needed to add the policy directly to the bucket. You used to have to create a policy away from the bucket page itself in the IAM area but now(I think) it needs to be in the bucket.

Is this a policy issue?

Thanks

2

I'm not really an AWS expert, but I think if you want to allow public access to an S3 bucket, then it should look something like this:

{
    "Sid": "PublicReadGetObject",
    "Effect": "Allow",
    "Principal": "*",
    "Action": "s3:GetObject",
    "Resource": "arn:aws:s3:::bucketname/*"
}
  • Hey Brad, not sure if this works when you have moved files from dev onto the bucket via ftp. Funnily enough if I upload a file from Craft on the bucket I can view it no problem. Thats down to the fact that the policy must only work for that user when uploaded to the cns – M dunbavan May 18 '18 at 9:35
  • It should work for either? Did you try it? – Brad Bell May 18 '18 at 18:14
  • Does the Sid you have there hold importance? So is it important to have that particular Sid? – M dunbavan May 18 '18 at 18:17
  • Nah, that can be whatever you want to call it. – Brad Bell May 18 '18 at 18:17
  • Nah that still throws 403 error s3-us-west-1.amazonaws.com/viaduct.co.uk/M-D-C-Assets/… – M dunbavan May 18 '18 at 18:28

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.