I followed @nystudio107 post here about setting up CraftCMS with Amazon S3 and Cloudfront and it works great except I can only upload if I have all public access enabled on the S3 bucket? The article specifically suggests disabling public access.
I suspect it's because I am trying to use the same IAM User, Group and policy across multiple buckets. This makes sense to us as we have a 'bucket' per client and would prefer not to create new policies, groups and users for every client.
I must admit I guessed at the possible code for 'global' buckets by inserting a 'wildcard' where there should be bucket names and it DOES seem to work for accessing assets across multiple buckets... just no luck with uploads?
Sample code from the policy JSON:
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": [
"s3:ListAllMyBuckets"
],
"Resource": "*"
},
{
"Effect": "Allow",
"Action": [
"s3:GetBucketLocation",
"s3:ListBucket",
"s3:PutObject",
"s3:GetObject",
"s3:DeleteObject",
"s3:GetObjectAcl",
"s3:PutObjectAcl"
],
"Resource": [
"arn:aws:s3:::*/*"
]
},
{
"Effect": "Allow",
"Action": [
"s3:GetBucketLocation",
"s3:ListBucket"
],
"Resource": [
"arn:aws:s3:::*"
]
}
]
}
Any advice/corrections/horrified expressions very welcome.
Many thanks
Martin