0

I am trying to create a s3 bucket to host some files as a website.

To do so I reckon I need to make each object public. So I created this policy:

    {
  "Id": "Policy1554620498897",
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "Stmt1554620491195",
      "Action": [
        "s3:GetObject"
      ],
      "Effect": "Allow",
      "Resource": "arn:aws:s3:::my-dummy-bucket",
      "Principal": "*"
    }
  ]
}

it resulted in this error:

enter image description here

So I changed the resource to "Resource": "arn:aws:s3:::my-dummy-bucket/*",

now I am getting this:

enter image description here

What does this 'access denied' is referring to? My lack of permission to change the bucket policy or the resources?

The bucket is newly created and there is no object in it yet.

  • 1
    @Tim "Principal": "*" means all users, whether authenticated or not -- i.e. public. – Michael - sqlbot Apr 7 '19 at 21:24
0

While the Access Denied error could be caused by lack of permissions, the most likely explanation is that either your bucket or your entire account is set to disallow public access on buckets.

See Using Amazon S3 Block Public Access in the S3 developer guide.

It isn't easy to "accidentally" make a bucket public but people still manage to do it... so AWS has recently added these settings to make sure you to a certain degree of trouble to expose your content to the world. The default setting for all new accounts is to disallow public buckets.

The earlier error occurred because "Resource": "arn:aws:s3:::example-bucket" refers to the bucket itself, not the objects in it, and s3:GetObject is only applicable to objects, not buckets. Adding /* changes the ARN to refer to all objects in the bucket, not the bucket itself.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.