I have a user, I'll call Alfred User, with attached IAM policy as follows
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": [
"s3:GetObject",
"s3:ListBucket"
],
"Resource": [
"arn:aws:s3:::my-bucket-name/*",
"arn:aws:s3:::my-bucket-name/",
"arn:aws:s3:::my-bucket-name"
]
}
]
}
In the IAM simulator, I get "Allowed" for GetObject, using this policy, and this ARN: arn:aws:s3:::my-bucket-name/my-object.xml
On the CLI, I get AccessDenied for the following command: aws s3 cp s3://my-bucket-name/my-object.xml temp/my-object.xml
A client error (AccessDenied) occurred when calling the GetObject operation: Access Denied
I've looked at everything I can think of but I can't explain this discrepancy. What am I missing?
Things I've tried
"creds" here mean "AWS IAM access keys"
- IAM simulator -- this works
- A different set of IAM creds -- this works
- Using
aws s3 ls s3://my-bucket-name/
-- this works with Alfred's IAM creds and with my creds - Compared policies to a similarly configured bucket in a different AWS account. The policies are identical, near as I can tell.
access_key_id
andsecret_access_key
defined somewhere?Deny
, there would override anAllow
elsewhere.