<p>I'm not really an AWS expert, but I think if you want to allow public access to an S3 bucket, then it should look something like this:</p>

<pre><code>{
    "Sid": "PublicReadGetObject",
    "Effect": "Allow",
    "Principal": "*",
    "Action": "s3:GetObject",
    "Resource": "arn:aws:s3:::bucketname/*"
}
</code></pre>

CC BY-SA 4.0
2018-05-18T09:35:26.863Z
Hey Brad, not sure if this works when you have moved files from dev onto the bucket via ftp. Funnily enough if I upload a file from Craft on the bucket I can view it no problem. Thats down to the fact that the policy must only work for that user when uploaded to the cns
M dunbavan
CC BY-SA 4.0
2018-05-18T18:14:56.057Z
It should work for either?  Did you try it?
Brad Bell
CC BY-SA 4.0
2018-05-18T18:17:17.130Z
Does the Sid you have there hold importance? So is it important to have that particular Sid?
M dunbavan
CC BY-SA 4.0
2018-05-18T18:17:44.707Z
Nah, that can be whatever you want to call it.
Brad Bell
CC BY-SA 4.0
2018-05-18T18:28:22.387Z
Nah that still throws 403 error http://s3-us-west-1.amazonaws.com/viaduct.co.uk/M-D-C-Assets/manufacturer-assets/manufacturer-banners/andtradition-furniture-lighting.jpg
M dunbavan
CC BY-SA 4.0
2018-05-18T22:24:11.783Z
That link loads for me? Seems to be what Amazon recommends, too: https://docs.aws.amazon.com/AmazonS3/latest/dev/example-bucket-policies.html#example-bucket-policies-use-case-2 (see Granting Read-Only Permission to an Anonymous User)
Brad Bell
CC BY-SA 4.0
2018-05-19T14:44:42.663Z
Hey Brad, so eventually I got to the bottom of this. The old way of adding a policy to the aws s3 doesn't apply. You have to directly add the policy to the bucket itself when you go into it from the console as the root logged in user. It used to be that you'd go through a different avenue. So what you have wrote above is correct but I just need to remember that the policy is added differently.
M dunbavan
CC BY-SA 4.0
2018-05-21T00:19:45.770Z
Ahh, interesting... I've only ever added it to the bucket directly. Regardless, glad you're sorted!
Brad Bell
CC BY-SA 4.0
2018-05-17T20:25:35.183Z
2018-05-17T20:25:35.183Z
Brad Bell
<p>I have created an s3 bucket in aws and added the correct permissions and user group etc. I have added the below policy:</p>

<pre><code>{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "VisualEditor0",
            "Effect": "Allow",
            "Action": [
                "s3:PutObject",
                "s3:GetObjectAcl",
                "s3:GetObject",
                "s3:ListAllMyBuckets",
                "s3:ListBucket",
                "s3:DeleteObject",
                "s3:GetBucketLocation",
                "s3:PutObjectAcl"
            ],
            "Resource": "*"
        },
        {
            "Sid": "VisualEditor1",
            "Effect": "Allow",
            "Action": [
                "s3:ListBucket",
                "s3:GetBucketLocation"
            ],
            "Resource": "arn:aws:s3:::bucketname"
        }
    ]
}
</code></pre>

<p>I uploaded the assets from a local folder via ftp to the bucket using transmit ftp client which was fine. I have then set the bucket up on craft cms as an asset source. I can upload files to s3 via the cms fine with no issues and view the image fine but when I try to access an image on the front end that was uploaded via the ftp I get access denied error 403:</p>

<pre><code>&lt;Error&gt;
&lt;Code&gt;AccessDenied&lt;/Code&gt;
&lt;Message&gt;Access Denied&lt;/Message&gt;
&lt;RequestId&gt;96E15AB155C47209&lt;/RequestId&gt;
&lt;HostId&gt;
our-hist-id-here
&lt;/HostId&gt;
&lt;/Error&gt;
</code></pre>

<p><strong>edit here</strong></p>

<p>So after some research I found out that you needed to add the policy directly to the bucket. You used to have to create a policy away from the bucket page itself in the IAM area but now(I think) it needs to be in the bucket.</p>

<p>Is this a policy issue?</p>

<p>Thanks</p>

<assets><s3>
Why do I get Access denied on s3 asset source images?
# Why do I get Access denied on s3 asset source images?

(Asked by: username_0 on 2018-05-17)

I have created an s3 bucket in aws and added the correct permissions and user group etc. I have added the below policy:
{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "VisualEditor0",
            "Effect": "Allow",
            "Action": [
                "s3:PutObject",
                "s3:GetObjectAcl",
                "s3:GetObject",
                "s3:ListAllMyBuckets",
                "s3:ListBucket",
                "s3:DeleteObject",
                "s3:GetBucketLocation",
                "s3:PutObjectAcl"
            ],
            "Resource": "*"
        },
        {
            "Sid": "VisualEditor1",
            "Effect": "Allow",
            "Action": [
                "s3:ListBucket",
                "s3:GetBucketLocation"
            ],
            "Resource": "arn:aws:s3:::bucketname"
        }
    ]
}

I uploaded the assets from a local folder via ftp to the bucket using transmit ftp client which was fine. I have then set the bucket up on craft cms as an asset source. I can upload files to s3 via the cms fine with no issues and view the image fine but when I try to access an image on the front end that was uploaded via the ftp I get access denied error 403:

AccessDenied
Access Denied
96E15AB155C47209

our-hist-id-here



edit here
So after some research I found out that you needed to add the policy directly to the bucket. You used to have to create a policy away from the bucket page itself in the IAM area but now(I think) it needs to be in the bucket.
Is this a policy issue?
Thanks

**Tags:** assets, s3

---

## 1 answers

### Answer by username_1 on 2018-05-17. Score: 2 | Accepted answer

I'm not really an AWS expert, but I think if you want to allow public access to an S3 bucket, then it should look something like this:
{
    "Sid": "PublicReadGetObject",
    "Effect": "Allow",
    "Principal": "*",
    "Action": "s3:GetObject",
    "Resource": "arn:aws:s3:::bucketname/*"
}

> **Comments:**
> **username_0**: Hey Brad, not sure if this works when you have moved files from dev onto the bucket via ftp. Funnily enough if I upload a file from Craft on the bucket I can view it no problem. Thats down to the fact that the policy must only work for that user when uploaded to the cns  
> **username_1**: It should work for either?  Did you try it?  
> **username_0**: Does the Sid you have there hold importance? So is it important to have that particular Sid?  
> **username_1**: Nah, that can be whatever you want to call it.  
> **username_0**: Nah that still throws 403 error http://s3-us-west-1.amazonaws.com/viaduct.co.uk/M-D-C-Assets/manufacturer-assets/manufacturer-banners/andtradition-furniture-lighting.jpg  
> **username_1**: That link loads for me? Seems to be what Amazon recommends, too: https://docs.aws.amazon.com/AmazonS3/latest/dev/example-bucket-policies.html#example-bucket-policies-use-case-2 (see Granting Read-Only Permission to an Anonymous User)  
> **username_0**: Hey Brad, so eventually I got to the bottom of this. The old way of adding a policy to the aws s3 doesn't apply. You have to directly add the policy to the bucket itself when you go into it from the console as the root logged in user. It used to be that you'd go through a different avenue. So what you have wrote above is correct but I just need to remember that the policy is added differently.  
> **username_1**: Ahh, interesting... I've only ever added it to the bucket directly. Regardless, glad you're sorted!  

---

