1

Which permission needed to perform move action on objects within the same S3 bucket?

To clarify, we have a bucket named BCK and two folders inside named DIR1 & DIR2. An IAM user needs to move objects within DIR1 to DIR2 and when they perform the action from the management console management they get the an error "access denied".

The only policy attached to the user is:

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "VisualEditor0",
            "Effect": "Allow",
            "Action": [
                "s3:GetObject",
                "s3:PutObject",
                "s3:DeleteObject",
                "s3:ListBucket",
                "s3:ListBucketVersions"
            ],
            "Resource": [
                "arn:aws:s3:::BCK/*",
                "arn:aws:s3:::BCK"
            ]
        },
        {
            "Sid": "VisualEditor2",
            "Effect": "Allow",
            "Action": [
                "s3:ListAllMyBuckets",
                "s3:HeadBucket"
            ],
            "Resource": "*"
        }
    ]
}
John Rotenstein
  • 241,921
  • 22
  • 380
  • 470
NAMMOUS Khalid
  • 13
  • 1
  • 4
  • Are the objects possibly encrypted with KMS? [amazon web services - permissions required to copy S3 file through console? - Stack Overflow](https://stackoverflow.com/questions/62755606/permissions-required-to-copy-s3-file-through-console) Did you check CloudTrail to see whether there is more information available in the failed API call? – John Rotenstein Dec 08 '21 at 10:40
  • we don't configure cloudtrail to cach API calls and object are not server side encrypted. – NAMMOUS Khalid Dec 08 '21 at 13:15

1 Answers1

3

There is no "move" command in Amazon S3. Instead, it requires a combination of CopyObject and DeleteObject. You have already provided these permissions.

The Amazon S3 management console also performs additional steps during the copy operation, such as viewing/setting permissions on each object. Therefore, add these permissions:

  • s3:GetObjectAcl
  • s3:PutObjectAcl
John Rotenstein
  • 241,921
  • 22
  • 380
  • 470