To grant access, policies must have an action that has an applicable resource or condition

user_517529 0
Viewed 11129

Policy json

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "...",
      "Effect": "Allow",
      "Action": [
        "s3:*"
      ],
      "Resource": [
        "arn:aws:s3:::bucket-name"
      ]
    }
  ]
}

This is whats shown as a warning in the AWS console:

This policy defines some actions, resources, or conditions that do not provide permissions. To grant access, policies must have an action that has an applicable resource or condition.

There is even link provided in that warning that goes here: http://docs.aws.amazon.com/IAM/latest/UserGuide/troubleshoot_policies.html?icmpid=docs_iam_console#policy-summary-not-grant-permissions

But trying what they suggest doesn't help, the policy summary still complains and I still can't access the bucket from my code.

Update: When I set the resource to "Resource": "*" it stops complaining in the console but the code still can't upload to the bucket.

Update2: The problem was that the bucket name in my code wasn't correct (as I tried a different tutorial and have not changed the bucketname in it).

amazon-web-services amazon-s3
1 Answers

One of the reasons I encounter is that I list the bucket resource as:

arn:aws:s3:::my-datasets
arn:aws:s3:::my-datasets/*

But under my "my-datasets" bucket there is no child folder. Thus the "/*" confuses AWS because when it evaluates this policy it can't find anything under "my-datasets". After I created a new folder under "my-datasets" the warning is gone.

user_63028030
Related