Answers.Body: <p>I'm not really an AWS expert, but I think if you want to allow public access to an S3 bucket, then it should look something like this:</p>
  
  <pre><code>{
      "Sid": "PublicReadGetObject",
      "Effect": "Allow",
      "Principal": "*",
      "Action": "s3:GetObject",
      "Resource": "arn:aws:s3:::bucketname/*"
  }
  </code></pre>
  
Answers.ContentLicense: CC BY-SA 4.0
Answers.CreationDate: 2018-05-18T09:35:26.863Z
Answers.Text: Hey Brad, not sure if this works when you have moved files from dev onto the bucket via ftp. Funnily enough if I upload a file from Craft on the bucket I can view it no problem. Thats down to the fact that the policy must only work for that user when uploaded to the cns
Answers.UserDisplayName: M dunbavan
Answers.ContentLicense: CC BY-SA 4.0
Answers.CreationDate: 2018-05-18T18:14:56.057Z
Answers.Text: It should work for either?  Did you try it?
Answers.UserDisplayName: Brad Bell
Answers.ContentLicense: CC BY-SA 4.0
Answers.CreationDate: 2018-05-18T18:17:17.130Z
Answers.Text: Does the Sid you have there hold importance? So is it important to have that particular Sid?
Answers.UserDisplayName: M dunbavan
Answers.ContentLicense: CC BY-SA 4.0
Answers.CreationDate: 2018-05-18T18:17:44.707Z
Answers.Text: Nah, that can be whatever you want to call it.
Answers.UserDisplayName: Brad Bell
Answers.ContentLicense: CC BY-SA 4.0
Answers.CreationDate: 2018-05-18T18:28:22.387Z
Answers.Text: Nah that still throws 403 error http://s3-us-west-1.amazonaws.com/viaduct.co.uk/M-D-C-Assets/manufacturer-assets/manufacturer-banners/andtradition-furniture-lighting.jpg
Answers.UserDisplayName: M dunbavan
Answers.ContentLicense: CC BY-SA 4.0
Answers.CreationDate: 2018-05-18T22:24:11.783Z
Answers.Text: That link loads for me? Seems to be what Amazon recommends, too: https://docs.aws.amazon.com/AmazonS3/latest/dev/example-bucket-policies.html#example-bucket-policies-use-case-2 (see Granting Read-Only Permission to an Anonymous User)
Answers.UserDisplayName: Brad Bell
Answers.ContentLicense: CC BY-SA 4.0
Answers.CreationDate: 2018-05-19T14:44:42.663Z
Answers.Text: Hey Brad, so eventually I got to the bottom of this. The old way of adding a policy to the aws s3 doesn't apply. You have to directly add the policy to the bucket itself when you go into it from the console as the root logged in user. It used to be that you'd go through a different avenue. So what you have wrote above is correct but I just need to remember that the policy is added differently.
Answers.UserDisplayName: M dunbavan
Answers.ContentLicense: CC BY-SA 4.0
Answers.CreationDate: 2018-05-21T00:19:45.770Z
Answers.Text: Ahh, interesting... I've only ever added it to the bucket directly. Regardless, glad you're sorted!
Answers.UserDisplayName: Brad Bell
Answers.ContentLicense: CC BY-SA 4.0
Answers.CreationDate: 2018-05-17T20:25:35.183Z
Answers.LastActivityDate: 2018-05-17T20:25:35.183Z
Answers.UserDisplayName: Brad Bell
Body: <p>I have created an s3 bucket in aws and added the correct permissions and user group etc. I have added the below policy:</p>
  
  <pre><code>{
      "Version": "2012-10-17",
      "Statement": [
          {
              "Sid": "VisualEditor0",
              "Effect": "Allow",
              "Action": [
                  "s3:PutObject",
                  "s3:GetObjectAcl",
                  "s3:GetObject",
                  "s3:ListAllMyBuckets",
                  "s3:ListBucket",
                  "s3:DeleteObject",
                  "s3:GetBucketLocation",
                  "s3:PutObjectAcl"
              ],
              "Resource": "*"
          },
          {
              "Sid": "VisualEditor1",
              "Effect": "Allow",
              "Action": [
                  "s3:ListBucket",
                  "s3:GetBucketLocation"
              ],
              "Resource": "arn:aws:s3:::bucketname"
          }
      ]
  }
  </code></pre>
  
  <p>I uploaded the assets from a local folder via ftp to the bucket using transmit ftp client which was fine. I have then set the bucket up on craft cms as an asset source. I can upload files to s3 via the cms fine with no issues and view the image fine but when I try to access an image on the front end that was uploaded via the ftp I get access denied error 403:</p>
  
  <pre><code>&lt;Error&gt;
  &lt;Code&gt;AccessDenied&lt;/Code&gt;
  &lt;Message&gt;Access Denied&lt;/Message&gt;
  &lt;RequestId&gt;96E15AB155C47209&lt;/RequestId&gt;
  &lt;HostId&gt;
  our-hist-id-here
  &lt;/HostId&gt;
  &lt;/Error&gt;
  </code></pre>
  
  <p><strong>edit here</strong></p>
  
  <p>So after some research I found out that you needed to add the policy directly to the bucket. You used to have to create a policy away from the bucket page itself in the IAM area but now(I think) it needs to be in the bucket.</p>
  
  <p>Is this a policy issue?</p>
  
  <p>Thanks</p>
  
Tags: <assets><s3>
Title: Why do I get Access denied on s3 asset source images?
ThreadText: # Why do I get Access denied on s3 asset source images?
  
  (Asked by: username_0 on 2018-05-17)
  
  I have created an s3 bucket in aws and added the correct permissions and user group etc. I have added the below policy:
  
  ```
  {
      "Version": "2012-10-17",
      "Statement": [
          {
              "Sid": "VisualEditor0",
              "Effect": "Allow",
              "Action": [
                  "s3:PutObject",
                  "s3:GetObjectAcl",
                  "s3:GetObject",
                  "s3:ListAllMyBuckets",
                  "s3:ListBucket",
                  "s3:DeleteObject",
                  "s3:GetBucketLocation",
                  "s3:PutObjectAcl"
              ],
              "Resource": "*"
          },
          {
              "Sid": "VisualEditor1",
              "Effect": "Allow",
              "Action": [
                  "s3:ListBucket",
                  "s3:GetBucketLocation"
              ],
              "Resource": "arn:aws:s3:::bucketname"
          }
      ]
  }
  
  ```
  
  I uploaded the assets from a local folder via ftp to the bucket using transmit ftp client which was fine. I have then set the bucket up on craft cms as an asset source. I can upload files to s3 via the cms fine with no issues and view the image fine but when I try to access an image on the front end that was uploaded via the ftp I get access denied error 403:
  
  ```
  <Error>
  <Code>AccessDenied</Code>
  <Message>Access Denied</Message>
  <RequestId>96E15AB155C47209</RequestId>
  <HostId>
  our-hist-id-here
  </HostId>
  </Error>
  
  ```
  
  **edit here**
  
  So after some research I found out that you needed to add the policy directly to the bucket. You used to have to create a policy away from the bucket page itself in the IAM area but now(I think) it needs to be in the bucket.
  
  Is this a policy issue?
  
  Thanks
  
  **Tags:** assets, s3
  
  
  ---
  
  ## 1 answers
  
  ### Answer by username_1 on 2018-05-17. Score: 2 | Accepted answer
  
  I'm not really an AWS expert, but I think if you want to allow public access to an S3 bucket, then it should look something like this:
  
  ```
  {
      "Sid": "PublicReadGetObject",
      "Effect": "Allow",
      "Principal": "*",
      "Action": "s3:GetObject",
      "Resource": "arn:aws:s3:::bucketname/*"
  }
  
  ```
  
  > **Comments:**
  > **username_0**: Hey username_1, not sure if this works when you have moved files from dev onto the bucket via ftp. Funnily enough if I upload a file from Craft on the bucket I can view it no problem. Thats down to the fact that the policy must only work for that user when uploaded to the cns  
  > **username_1**: It should work for either?  Did you try it?  
  > **username_0**: Does the Sid you have there hold importance? So is it important to have that particular Sid?  
  > **username_1**: Nah, that can be whatever you want to call it.  
  > **username_0**: Nah that still throws 403 error http://s3-us-west-1.amazonaws.com/viaduct.co.uk/M-D-C-Assets/manufacturer-assets/manufacturer-banners/andtradition-furniture-lighting.jpg  
  > **username_1**: That link loads for me? Seems to be what Amazon recommends, too: https://docs.aws.amazon.com/AmazonS3/latest/dev/example-bucket-policies.html#example-bucket-policies-use-case-2 (see Granting Read-Only Permission to an Anonymous User)  
  > **username_0**: Hey username_1, so eventually I got to the bottom of this. The old way of adding a policy to the aws s3 doesn't apply. You have to directly add the policy to the bucket itself when you go into it from the console as the root logged in user. It used to be that you'd go through a different avenue. So what you have wrote above is correct but I just need to remember that the policy is added differently.  
  > **username_1**: Ahh, interesting... I've only ever added it to the bucket directly. Regardless, glad you're sorted!  
  
  ---
  
  