S3 "Access Denied" to Bucket

Question

I try to allow one of our Devs (myapp-dev1) the access to one explicit S3-Bucket.

I created a policy which should allow CRUD options (he should be able to write and read image files into that bucket, and only into this.
```
"s3:PutObject",
"s3:GetObject",
"s3:DeleteObject",
"s3:ListObjects"
```
I created a User named dev1 and assigned him to that new policy (the user is not in a Group nor has a Role)
I created a Bucket named accordingly ARN: arn:aws:s3:::myapp-dev1-bucket

Then in this bucket I switched to "Bucket Policy" and used the "Policy Generator" and allowed every action for that moment. All other settings failed so far, this one too. It looks like this:

{
  "Id": "Policy123456789",
  "Version": "2012-10-17",
  "Statement": [
    {
       "Sid": "Stmt123456789",
       "Action": "s3:*",
       "Effect": "Allow",
       "Resource": "arn:aws:s3:::myapp-dev1-bucket",
       "Principal": {
          "AWS": [
              "arn:aws:iam::1234567890:user/myapp-dev1"
           ]
       }
    }
  ]
}

But I still get an

Excon::Error::Forbidden: Expected(200) <=> Actual(403 Forbidden)

What I have done wrong?
What I am missing?
Does the User must also be allowed to list buckets?

Please help!

Is this bucket being used to serve images/assets or to serve a compiled single page application? — ruby_newbie, Jan 29 '18 at 06:16
It’s used to serve Images, uploaded by the app through Carrierwave. — Jan, Jan 29 '18 at 07:27

score 0 · Answer 1 · answered Jan 28 '18 at 17:20

Try this,

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "s3:ListBucket"
            ],
            "Resource": [
                "arn:aws:s3:::Bucket_Name"
            ]
        },
        {
            "Effect": "Allow",
            "Action": [
                "s3:PutObject",
                "s3:GetObject",
                "s3:DeleteObject",
                "s3:ListObject"
            ],
            "Resource": [
                "arn:aws:s3:::Bucket_Name/*"
            ]
        }
    ]
}

S3 "Access Denied" to Bucket

1 Answers1