AWS S3 Action does not apply to any resource(s) in statement

user_2785937 0
Viewed 635

Hi I follow the instruction of this answerd and got the same error.

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "Stmt1614469992506",
      "Principal": "*",
      "Action": [
        "s3:DeleteObject",
        "s3:GetObject",
        "s3:ListBucket",
        "s3:PutObject"
      ],
      "Effect": "Allow",
      "Resource": "arn:aws:s3:::<S3_Name>/*"
    }
  ]
}

I got the error:

Action does not apply to any resource(s) in statement

I check the documentation and I can't found any solution.

amazon-web-services amazon-s3
2 Answers

ListBucket should be on the bucket resource itself, where as the other Object Actions should be on the objects within the bucket. so, we need /* for all the objects of the bucket.

IAM Policy:

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "s3:PutObject",
                "s3:GetObject",
                "s3:DeleteObject"
            ],
            "Resource": "arn:aws:s3:::<S3_Name>/*"
        },
        {
            "Effect": "Allow",
            "Action": "s3:ListBucket",
            "Resource": "arn:aws:s3:::<S3_Name>"
        }
    ]
}

Bucket Policy:

Same as IAM Policy, except it has Principal attached.

"Principal":"*" or "Principal":{"AWS":"*"} will give public access and

"Principal":{"AWS":"arn:aws:iam::AccountNumber-WithoutHyphens:root"} will give access to entire Aws Account. Some details here and here

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Principal": {
                "AWS": "arn:aws:iam::111122223333:root"
            },
            "Action": [
                "s3:PutObject",
                "s3:GetObject",
                "s3:DeleteObject"
            ],
            "Resource": "arn:aws:s3:::<S3_Name>/*"
        },
        {
            "Effect": "Allow",
            "Principal": {
                "AWS": "arn:aws:iam::111122223333:root"
            },
            "Action": "s3:ListBucket",
            "Resource": "arn:aws:s3:::<S3_Name>"
        }
    ]
}
user_101868080

you can try this

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Principal": "*",
            "Action": [
                "s3:DeleteObject",
                "s3:GetObject",
                "s3:ListBucket",
                "s3:PutObject"
            ],
            "Resource": [
                "arn:aws:s3:::<S3_Name>",
                "arn:aws:s3:::<S3_Name>/*"
            ]
        }
    ]
}
user_73838650
Related