How can I resolve AWS::S3::Errors:: Access Denied?

Question

Hi I've followed the link below to configure paperclip with AWS S3 but I keep getting a "AWS::S3::ERRORS::AccessDenied (Access Denied):" from the heroku logs. If I remove my block public access settings, I am able to upload an image to my S3 folder without fail.

May I know if there's anything I should configure to make this work properly? My ENV files are 100% correct as they were able to connect when I removed block all public access..

I currently have a bucket policy like that and no CORS configuration

{
"Version": "2012-11-17",
"Id": "Policy1231xxx1231xx",
"Statement": [
    {
        "Sid": "Stmt1123123123",
        "Effect": "Allow",
        "Principal": {
            "AWS": "arn:aws:iam::2123123123:user/someuser"
        },
        "Action": "s3:*",
        "Resource": "arn:aws:s3:::somename"
    }
]

}

yes they are correct I edited them to comply with security purposes — stackedodds, Jun 04 '20 at 18:16
Could you try `"Resource": ["arn:aws:s3:::somename","arn:aws:s3:::somename/*" ]`? @stackedodds — jellycsc, Jun 05 '20 at 00:02
I managed to get past the invalid Json part but I am still getting AWS::S3::Errors::AccessDenied. Should I remove block all public access? Cant seem to find a proper guide to integrate paperclip and s3.. — stackedodds, Jun 05 '20 at 06:05

Mani Ezhumalai · Answer 1 · 2020-06-05T19:16:56.163

2

Change your resource parameter like this

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "S3Permissions",
      "Action": "s3:*",
      "Effect": "Allow",
      "Resource": [
        "arn:aws:s3:::awsexamplebucket/*",
        "arn:aws:s3:::awsexamplebucket"
      ]
    }
  ]
}

Also you can refer this link to define your bucket policy https://aws.amazon.com/premiumsupport/knowledge-center/s3-access-denied-bucket-policy/

edited Jun 05 '20 at 19:16

answered Jun 05 '20 at 19:09

Mani Ezhumalai

379
2
8

Please note that this suggestion does not differ much from the above changes other than removing the principal. By removing the principal, the access control is effectively weakened. – stackedodds Jun 06 '20 at 04:57
try to change resouce paramater like that – Mani Ezhumalai Jun 06 '20 at 04:59

How can I resolve AWS::S3::Errors:: Access Denied?

1 Answers1