0

I need to create an S3 bucket to host the assets uploaded by my users.

I've tried to create an IAM user dedicated to S3 which basically means: - access only S3 and nothing else - programmatically - access only the buckets it has to - no bucket management, doesn't need to

Here is the policy attached to this user:

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "VisualEditor0",
            "Effect": "Allow",
            "Action": [
                "s3:DeleteObjectTagging",
                "s3:DeleteObjectVersion",
                "s3:GetObjectVersionTagging",
                "s3:PutObjectVersionTagging",
                "s3:DeleteObjectVersionTagging",
                "s3:PutObject",
                "s3:GetObjectAcl",
                "s3:GetObject",
                "s3:GetObjectVersionAcl",
                "s3:GetObjectTagging",
                "s3:PutObjectTagging",
                "s3:GetObjectVersionForReplication",
                "s3:DeleteObject",
                "s3:GetObjectVersion"
            ],
            "Resource": "arn:aws:s3:::my-bucket/"
        }
    ]
}

This policy is called AssetManager and if I list-user

ngw@bluemonday  ~  aws iam list-users --profile utelier-admin
{
    "Users": [
        {
            "Path": "/",
            "UserName": "AssetManager",
            "UserId": "USERID",
            "Arn": "arn:aws:iam::1234567890:user/AssetManager",
            "CreateDate": "2018-09-16T13:05:32Z"
        }
    ]
}

Then I try to create the bucket my-bucket and I'm quite lost, I don't know when and where to add my shiny new user. I see I can add my "account" or even access to "other AWS accounts" but no mention of my IAM user, this is very confusing.

Result: my current setup does not work:

2.5.1 :005 > require 'aws-sdk-s3'
 => false
2.5.1 :006 > s3 = Aws::S3::Resource.new(region:'eu-west-1', access_key_id: 'ACCESSKEY', secret_access_key: 'SECRET')
 => #<Aws::S3::Resource:0x00007fc88d384b88 @client=#<Aws::S3::Client>>
2.5.1 :007 > obj = s3.bucket('my-bucket').object('test.jpg')
 => #<Aws::S3::Object:0x00007fc88d6cb4b8 @bucket_name="my-bucket", @key="test.jpg", @data=nil, @client=#<Aws::S3::Client>>
2.5.1 :008 > obj.upload_file('/Users/ngw/something.jpg')
Traceback (most recent call last):
        ...
        1: from /Users/ngw/.rvm/gems/ruby-2.5.1/gems/aws-sdk-core-3.27.0/lib/seahorse/client/plugins/raise_response_errors.rb:15:in `call'
Aws::S3::Errors::AccessDenied (Access Denied)

Can anybody shed a light? Thanks in advance.

  • Were you successful in creating my-bucket? You don't need to add your new user anywhere in S3 - you've already given it permissions to access. Use its credentials to make some S3 calls to that bucket and it should work. – ceejayoz Sep 16 '18 at 16:48
  • Question updated – ngw Sep 16 '18 at 16:49
  • Your IAM user will have security credentials for access_key_id and secret_access_key... – 9bO3av5fw5 Sep 16 '18 at 17:23
  • @9bO3av5fw5 yes, absolutely, that’s what I used – ngw Sep 16 '18 at 18:24
0

The problem was that I had to be more explicit:

"Resource": "arn:aws:s3:::my-bucket/*"

The "/*" was missing.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.