AWS S3, can not add bucket policy, get "Acess Denied" error

user_6365148 0
Viewed 698

I have read everything I can read on the Internet or the official documents, but this error is so awkward. I want to add following policy on to my bucket:

{   "Version":"2012-10-17",   "Statement":[
    {
      "Sid":"AddPerm",
      "Effect":"Allow",
      "Principal": "*",
      "Action":["s3:GetObject"],
      "Resource":["arn:aws:s3:::mybucket/*"]
    }   ] 
}

however, the only thing I can get is access denied:

I've tried to set this, but it did not work: enter image description here

What's more, I tried to add bucket policy on my friend account, and it works, the only difference between these two accounts is that my account has an elastic beanstalk(I do not know whether this would affect the result), so please tell me what should I do?

amazon-web-services amazon-s3
1 Answers

Check what is the policy on that bucket and what is the policy the user under which you are logged in have. For being able to to change bucket policy you need the PutBucketPolicy permission. Keep in mind that Deny anywhere will block you from doing the specified action.

The fix would be adding s3:PutBucketPolicy to yourself and then you should be able to change the s3 bucket permissions. The user policy and the bucket policy on the same account should be "a union" of both policies, but it would be "an intersection" if you are accessing another account - but it seems that you are changing a bucket in your account, so you should be fine with that.

If you cannot change your user IAM policy or you accidentally put Deny on the bucket you will have to log in as the account root and try to fix that this way.

Also, make sure that making all objects in your bucket public is what you plan to do. You allow only GetObject, so if this should be some statically hosted content, this should be fine.

user_18738620
Related