Aws S3 Only PutObject Policy

Question

i'm trying to setup a Only PutObject policy to by bucket as following:

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "Stmt####",
            "Effect": "Allow",
            "Action": [
                "s3:PutObject",
                "s3:PutObjectAcl",
                "s3:PutObjectVersionAcl"
            ],
            "Resource": [
                "arn:aws:s3:::my-bucket/*"
            ]
        }
    ]
}

However when i try to upload a file thought AWS SDK I receive a 403 response from AWS. I'm absolutely sure to use the correct access key of the IAM user that has this policy attached to it.

Anyone knows why AWS3 complain with this policy when it shouldn't?

Edit:

After hours of trials, I came across a weird behaviour which i would like to be explained.

If I add s3:ListBucket to the above policy it just works fine. Without it, it will return a 403. Why amazon force me to put ListBucket action when i don't want to have it?

Thanks

score -3 · Answer 1 · answered Jul 29 '15 at 18:11

-3

Best way to troubleshoot this is to give your policy following action and resources:

"Action": [
    "s3:*"
],
"Resource": [
    "arn:aws:s3:::my-bucket",
    "arn:aws:s3:::my-bucket/*"
]

This will confirm you're using correct access key. If it goes through, you're most likely using unauthorized actions (e.g. s3:ListBucket). You can use CloudTrail to find which unauthorized actions are being called.

answered Jul 29 '15 at 18:11

aalimovs

175
1
2
10

1

Thank you a lot @aalimovs, i try it a lots combination and I came a cross that if I don't put `ListBucket` **Action** to the policy it give 403, if I add that it succesfully upload the file, do you know why this happen? – Fabrizio Fenoglio Jul 30 '15 at 13:28
Can you show how exactly you are uploading the file? – aalimovs Jul 30 '15 at 21:32
Thanks for your support, i'm uploading files trough **filesystem** library of PHP https://github.com/thephpleague/flysystem, and using the Aws3 adapter: https://github.com/thephpleague/flysystem-aws-s3-v3, Uploading function: https://github.com/thephpleague/flysystem-aws-s3-v3/blob/master/src/AwsS3Adapter.php#L495 – Fabrizio Fenoglio Jul 31 '15 at 13:36

Aws S3 Only PutObject Policy

1 Answers1