0

I'm hosting assets for Craft 3 site on AWS S3.

I'm trying to figure out how to give the site (and its users) access to the files without making them broadly publicly available.

I found a suggestion for the right User/Group permissions here. Those are:

{
"Version": "2012-10-17",
"Statement": [
    {
        "Effect": "Allow",
        "Action": [
            "s3:ListAllMyBuckets"
        ],
        "Resource": "*"
    },
    {
        "Effect": "Allow",
        "Action": [
            "s3:GetBucketLocation",
            "s3:ListBucket",
            "s3:PutObject",
            "s3:GetObject",
            "s3:DeleteObject",
            "s3:GetObjectAcl",
            "s3:PutObjectAcl"
        ],
        "Resource": [
            "arn:aws:s3:::bucketname/*"
        ]
    },
    {
        "Effect": "Allow",
        "Action": [
            "s3:GetBucketLocation",
            "s3:ListBucket"
        ],
        "Resource": [
            "arn:aws:s3:::bucketname"
        ]
    }
]
}

I attached this policy to an IAM Group, in which the IAM User is a member. I am using that IAM User's credentials on Craft 3 for access to the files.

However, I get a 'Access denied" error. The only way I've found to get rid of that error is to grant full public access to the bucket. It doesn't seem right to me that the files are publicly accessible. This means they'll end up on Google, etc., and basically be exposed. On the site itself only logged in users have access to many of the assets in the S3 bucket.

Have I missed a step somewhere in this configuration?

  • I made a little thing for my access policy for craft: craft.btk.scot – billythekid Jul 10 at 7:44
  • What are you doing when you get the Access Denied error? Are you trying to embed them onto a website or what's your use case? – RitterKnight Jul 10 at 15:40
  • @ritterknight I am selecting an asset in the back end and click the view asset option. – inspirednz Jul 10 at 17:01

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.