How to get the user's canonical ID for adding a S3 permission

To grant permissions to an IAM user on a bucket, you'll need to create a Bucket Policy - which is an JSON document. The "Access for other AWS accounts" option in the ACL is for granting access to other (wholly separate) root AWS accounts, not for granting access to IAM users within your own root account.

Creating/Editing a Policy

To access the bucket policy, browse to a bucket in the S3 web console. There you'll see the Overview/Properties/Permissions/Management tabs. Under Permissions there is a sub-tab called "Bucket Policy". At the bottom of the Bucket Policy page there is a link to a "Policy Generator", which will generate the JSON for you. (or the direct link is http://awspolicygen.s3.amazonaws.com/policygen.html)

Identifying an IAM User to Assign Rights To

To identify the IAM user you want to grant permissions to, you'll use an ARN (Amazon Resource Name). The ARN format for IAM users is as follows: "arn:aws:iam::{Account-ID}:user/{Username}" (note the curly braces aren't part of the format). An example IAM ARN looks like this: arn:aws:iam::100123456789:user/Daniel

To get your numeric account ID, sign in as the root user and click your user name in the upper right corner of the page and choose "My Account" (which takes you to https://console.aws.amazon.com/billing/home?#/account ). The account ID is listed under "Account Settings" at the top of the page.

Plug that user ARN into the "Principal" field of the policy generator, and choose which action(s) to grant to the user from the dropdown list.

Specifying what to grant permissions on

To grant permissions to a bucket, or a set of files (objects) within a bucket you need to enter an ARN that identifies the bucket, or some subset of objects within the bucket into the "Amazon Resource Name" field (e.g. if I had a bucket called daniels-stuff and a folder in that bucket called images that I wanted to grant access to then I could provide an ARN such as arn:aws:s3:::daniels-stuff/images/*

Hit "Add Statement" when you've put in the necessary information and then hit "Generate Policy". Note you can put multiple statements (access right assignments) into the one policy.

More Info

Finally, there is a good primer to s3 bucket policies at https://brandonwamboldt.ca/understanding-s3-permissions-1662/ which includes some example policies.

Good luck (although I assume you've probably solved your issue now, others may find this helpful).

For getting the canonical ID, one of the simplest ways is to use CLI and run aws s3api list-buckets command. You will get the ID in the output.

There are other ways also for getting the canonical ID and are clearly described in the aws docs: https://docs.aws.amazon.com/general/latest/gr/acct-identifiers.html

list-buckets aws docs: https://docs.aws.amazon.com/cli/latest/reference/s3api/list-buckets.html

To find Canonical ID of account follow the below steps:

1. Click on your username which is located in the top menu bar.
2. A drop down will appear. Select My Security Credentials.
3. Canonical user ID is there

You can also get your Canonical ID for your IAM user from the CLI command:

List all the buckets and your iam Canonical ID:

aws s3api list-buckets

And if you just want to get your Canonical ID:

aws s3api list-buckets | grep ID

Keep in mind, the above commands are done via CLI where you would have set up your profile already.

1. Create a new policy using the following JSON

{
  "Version": "2012-10-17",
  "Statement": [
      {
          "Effect": "Allow",
          "Action": [
              "s3:ListAllMyBuckets"
          ],
          "Resource": "arn:aws:s3:::*"
      },
      {
          "Effect": "Allow",
          "Action": [
              "s3:ListBucket",
              "s3:GetBucketLocation"
          ],
          "Resource": "arn:aws:s3:::<your_bucket_name_here>"
      },
      {
          "Sid": "VisualEditor0",
          "Effect": "Allow",
          "Action": [
              "s3:PutObject",
              "s3:GetObject",
              "s3:ListBucket",
              "s3:DeleteObject",
              "s3:GetObjectVersion"
          ],
          "Resource": "arn:aws:s3:::<your_bucket_name_here>/*"
      }
  ]
}

**2. Assign the policy to the user or a user group

Note:

I kept on getting Access Denied (Status code: 403) errors because I was missing the first 2 objects in the JSON array above. You have to give your user permission to:

• See all your buckets
• List the specific bucket and get its location

before it even gets a chance to perform any actions on the bucket contents at all.

How to view the Canonical ID in AWS.

In the top Click your user Account drop down box . Click My Security Credential. In the console  Click the Account Identifiers Pls don’s share your credential info. To view the Canonical ID in AWS

Pala ( VR.PL)

paste this in the terminal

aws s3api list-buckets --query "Owner.ID"

Make sure to have * at the end of the line to grant permissions to everything!

arn:aws:s3:::daniels-stuff/images/*