<p>I'm no AWS expert but does your iam user have the correct access/secret keys as well?</p>

<p>While you're at it, you might as well grant PutObject, GetObject, and DeleteObject in that policy as well so Craft has access to the objects in it.</p>

<p>See this <a href="http://blogs.aws.amazon.com/security/post/Tx3VRSWZ6B3SHAV/Writing-IAM-Policies-How-to-grant-access-to-an-Amazon-S3-bucket" rel="nofollow">blog post</a> by Amazon for a good starting point. </p>

CC BY-SA 3.0
2016-02-23T00:05:01.440Z
2016-02-23T00:05:01.440Z
RitterKnight
<p>You need to allow to list bucket location. Also, I'm not confident if you'd be able to upload and delete objects from the bucket with that policy.</p>

<p>I'd go with:</p>

<pre><code>{
"Version": "2012-10-17",
"Statement": [
    {
        "Effect": "Allow",
        "Action": [
            "s3:ListAllMyBuckets"
        ],
        "Resource": "*"
    },
    {
        "Effect": "Allow",
        "Action": [
            "s3:GetBucketLocation",
            "s3:ListBucket",
            "s3:PutObject",
            "s3:GetObject",
            "s3:DeleteObject",
            "s3:GetObjectAcl",
            "s3:PutObjectAcl"
        ],
        "Resource": [
            "arn:aws:s3:::bucketname/*"
        ]
    },
    {
        "Effect": "Allow",
        "Action": [
            "s3:GetBucketLocation",
            "s3:ListBucket"
        ],
        "Resource": [
            "arn:aws:s3:::bucketname"
        ]
    }
]
}
</code></pre>

CC BY-SA 3.0
2016-05-12T05:08:30.510Z
This policy is exactly what you need an no more. I experimented with at least 8 different permutations of things like this seeking to grant access to only the minimum that would allow the CraftCMS "Add Asset" UI to render and get the asset source working. ^^ that solution nails it, thanks for sharing.
Joe Goggins
CC BY-SA 3.0
2017-05-31T12:11:09.587Z
Hi guys. I get an error with this policy ("Missing required field Principal"). I know I need to add "Principal": { "AWS": [ "my-account-num" ] }, but I just don't know where in the policy?
Ian Ebden
CC BY-SA 3.0
2017-05-31T17:09:42.807Z
@IanEbden Try adding the policy directly to a user or to a user group instead of to the bucket itself.
Jameal G
CC BY-SA 4.0
2016-02-24T12:31:58.697Z
2019-07-17T06:42:07.273Z
2019-07-17T06:42:07.273Z
Andris Sevcenko
<p>I'm trying to setup an Asset source on S3, but i'm having trouble getting the correct permissions.</p>

<p>This is my current policy file:</p>

<pre class="lang-js prettyprint-override"><code>{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "s3:ListAllMyBuckets"
            ],
            "Resource": [
                "arn:aws:s3:::"
            ]
        },
        {
            "Effect": "Allow",
            "Action": [
                "s3:ListBucket"
            ],
            "Resource": [
                "arn:aws:s3:::bucketname"
            ]
        },
        {
            "Sid": "Stmt1456139254000",
            "Effect": "Allow",
            "Action": [
                "s3:*"
            ],
            "Resource": [
                "arn:aws:s3:::bucketname/*"
            ]
        }
    ]
}
</code></pre>

<p>This gives me "Permission denied" when trying to list the buckets.</p>

<assets><s3><sources><amazon>
Correct IAM settings for Amazon S3 bucket
# Correct IAM settings for Amazon S3 bucket

(Asked by: username_0 on 2016-02-22)

I'm trying to setup an Asset source on S3, but i'm having trouble getting the correct permissions.
This is my current policy file:
{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "s3:ListAllMyBuckets"
            ],
            "Resource": [
                "arn:aws:s3:::"
            ]
        },
        {
            "Effect": "Allow",
            "Action": [
                "s3:ListBucket"
            ],
            "Resource": [
                "arn:aws:s3:::bucketname"
            ]
        },
        {
            "Sid": "Stmt1456139254000",
            "Effect": "Allow",
            "Action": [
                "s3:*"
            ],
            "Resource": [
                "arn:aws:s3:::bucketname/*"
            ]
        }
    ]
}

This gives me "Permission denied" when trying to list the buckets.

**Tags:** assets, s3, sources, amazon


---

## 2 answers

### Answer by username_2 on 2016-02-24. Score: 14 | Accepted answer

You need to allow to list bucket location. Also, I'm not confident if you'd be able to upload and delete objects from the bucket with that policy.
I'd go with:
{
"Version": "2012-10-17",
"Statement": [
    {
        "Effect": "Allow",
        "Action": [
            "s3:ListAllMyBuckets"
        ],
        "Resource": "*"
    },
    {
        "Effect": "Allow",
        "Action": [
            "s3:GetBucketLocation",
            "s3:ListBucket",
            "s3:PutObject",
            "s3:GetObject",
            "s3:DeleteObject",
            "s3:GetObjectAcl",
            "s3:PutObjectAcl"
        ],
        "Resource": [
            "arn:aws:s3:::bucketname/*"
        ]
    },
    {
        "Effect": "Allow",
        "Action": [
            "s3:GetBucketLocation",
            "s3:ListBucket"
        ],
        "Resource": [
            "arn:aws:s3:::bucketname"
        ]
    }
]
}

> **Comments:**
> **username_3**: This policy is exactly what you need an no more. I experimented with at least 8 different permutations of things like this seeking to grant access to only the minimum that would allow the CraftCMS "Add Asset" UI to render and get the asset source working. ^^ that solution nails it, thanks for sharing.  
> **username_4**: Hi guys. I get an error with this policy ("Missing required field Principal"). I know I need to add "Principal": { "AWS": [ "my-account-num" ] }, but I just don't know where in the policy?  
> **username_5**: @IanEbden Try adding the policy directly to a user or to a user group instead of to the bucket itself.  

---

### Answer by username_1 on 2016-02-23. Score: 2

I'm no AWS expert but does your iam user have the correct access/secret keys as well?

While you're at it, you might as well grant PutObject, GetObject, and DeleteObject in that policy as well so Craft has access to the objects in it.

See this [blog post](http://blogs.aws.amazon.com/security/post/Tx3VRSWZ6B3SHAV/Writing-IAM-Policies-How-to-grant-access-to-an-Amazon-S3-bucket) by Amazon for a good starting point.


---

