Answers.Body: <p>I'm no AWS expert but does your iam user have the correct access/secret keys as well?</p>
  
  <p>While you're at it, you might as well grant PutObject, GetObject, and DeleteObject in that policy as well so Craft has access to the objects in it.</p>
  
  <p>See this <a href="http://blogs.aws.amazon.com/security/post/Tx3VRSWZ6B3SHAV/Writing-IAM-Policies-How-to-grant-access-to-an-Amazon-S3-bucket" rel="nofollow">blog post</a> by Amazon for a good starting point. </p>
  
Answers.ContentLicense: CC BY-SA 3.0
Answers.CreationDate: 2016-02-23T00:05:01.440Z
Answers.LastActivityDate: 2016-02-23T00:05:01.440Z
Answers.UserDisplayName: RitterKnight
Answers.Body: <p>You need to allow to list bucket location. Also, I'm not confident if you'd be able to upload and delete objects from the bucket with that policy.</p>
  
  <p>I'd go with:</p>
  
  <pre><code>{
  "Version": "2012-10-17",
  "Statement": [
      {
          "Effect": "Allow",
          "Action": [
              "s3:ListAllMyBuckets"
          ],
          "Resource": "*"
      },
      {
          "Effect": "Allow",
          "Action": [
              "s3:GetBucketLocation",
              "s3:ListBucket",
              "s3:PutObject",
              "s3:GetObject",
              "s3:DeleteObject",
              "s3:GetObjectAcl",
              "s3:PutObjectAcl"
          ],
          "Resource": [
              "arn:aws:s3:::bucketname/*"
          ]
      },
      {
          "Effect": "Allow",
          "Action": [
              "s3:GetBucketLocation",
              "s3:ListBucket"
          ],
          "Resource": [
              "arn:aws:s3:::bucketname"
          ]
      }
  ]
  }
  </code></pre>
  
Answers.ContentLicense: CC BY-SA 3.0
Answers.CreationDate: 2016-05-12T05:08:30.510Z
Answers.Text: This policy is exactly what you need an no more. I experimented with at least 8 different permutations of things like this seeking to grant access to only the minimum that would allow the CraftCMS "Add Asset" UI to render and get the asset source working. ^^ that solution nails it, thanks for sharing.
Answers.UserDisplayName: Joe Goggins
Answers.ContentLicense: CC BY-SA 3.0
Answers.CreationDate: 2017-05-31T12:11:09.587Z
Answers.Text: Hi guys. I get an error with this policy ("Missing required field Principal"). I know I need to add "Principal": { "AWS": [ "my-account-num" ] }, but I just don't know where in the policy?
Answers.UserDisplayName: Ian Ebden
Answers.ContentLicense: CC BY-SA 3.0
Answers.CreationDate: 2017-05-31T17:09:42.807Z
Answers.Text: @IanEbden Try adding the policy directly to a user or to a user group instead of to the bucket itself.
Answers.UserDisplayName: Jameal G
Answers.ContentLicense: CC BY-SA 4.0
Answers.CreationDate: 2016-02-24T12:31:58.697Z
Answers.LastActivityDate: 2019-07-17T06:42:07.273Z
Answers.LastEditDate: 2019-07-17T06:42:07.273Z
Answers.UserDisplayName: Andris Sevcenko
Body: <p>I'm trying to setup an Asset source on S3, but i'm having trouble getting the correct permissions.</p>
  
  <p>This is my current policy file:</p>
  
  <pre class="lang-js prettyprint-override"><code>{
      "Version": "2012-10-17",
      "Statement": [
          {
              "Effect": "Allow",
              "Action": [
                  "s3:ListAllMyBuckets"
              ],
              "Resource": [
                  "arn:aws:s3:::"
              ]
          },
          {
              "Effect": "Allow",
              "Action": [
                  "s3:ListBucket"
              ],
              "Resource": [
                  "arn:aws:s3:::bucketname"
              ]
          },
          {
              "Sid": "Stmt1456139254000",
              "Effect": "Allow",
              "Action": [
                  "s3:*"
              ],
              "Resource": [
                  "arn:aws:s3:::bucketname/*"
              ]
          }
      ]
  }
  </code></pre>
  
  <p>This gives me "Permission denied" when trying to list the buckets.</p>
  
Tags: <assets><s3><sources><amazon>
Title: Correct IAM settings for Amazon S3 bucket
ThreadText: # Correct IAM settings for Amazon S3 bucket
  
  (Asked by: username_0 on 2016-02-22)
  
  I'm trying to setup an Asset source on S3, but i'm having trouble getting the correct permissions.
  
  This is my current policy file:
  
  ```js
  {
      "Version": "2012-10-17",
      "Statement": [
          {
              "Effect": "Allow",
              "Action": [
                  "s3:ListAllMyBuckets"
              ],
              "Resource": [
                  "arn:aws:s3:::"
              ]
          },
          {
              "Effect": "Allow",
              "Action": [
                  "s3:ListBucket"
              ],
              "Resource": [
                  "arn:aws:s3:::bucketname"
              ]
          },
          {
              "Sid": "Stmt1456139254000",
              "Effect": "Allow",
              "Action": [
                  "s3:*"
              ],
              "Resource": [
                  "arn:aws:s3:::bucketname/*"
              ]
          }
      ]
  }
  
  ```
  
  This gives me "Permission denied" when trying to list the buckets.
  
  **Tags:** assets, s3, sources, amazon
  
  
  ---
  
  ## 2 answers
  
  ### Answer by username_2 on 2016-02-24. Score: 14 | Accepted answer
  
  You need to allow to list bucket location. Also, I'm not confident if you'd be able to upload and delete objects from the bucket with that policy.
  
  I'd go with:
  
  ```
  {
  "Version": "2012-10-17",
  "Statement": [
      {
          "Effect": "Allow",
          "Action": [
              "s3:ListAllMyBuckets"
          ],
          "Resource": "*"
      },
      {
          "Effect": "Allow",
          "Action": [
              "s3:GetBucketLocation",
              "s3:ListBucket",
              "s3:PutObject",
              "s3:GetObject",
              "s3:DeleteObject",
              "s3:GetObjectAcl",
              "s3:PutObjectAcl"
          ],
          "Resource": [
              "arn:aws:s3:::bucketname/*"
          ]
      },
      {
          "Effect": "Allow",
          "Action": [
              "s3:GetBucketLocation",
              "s3:ListBucket"
          ],
          "Resource": [
              "arn:aws:s3:::bucketname"
          ]
      }
  ]
  }
  
  ```
  
  > **Comments:**
  > **username_3**: This policy is exactly what you need an no more. I experimented with at least 8 different permutations of things like this seeking to grant access to only the minimum that would allow the CraftCMS "Add Asset" UI to render and get the asset source working. ^^ that solution nails it, thanks for sharing.  
  > **username_4**: Hi guys. I get an error with this policy ("Missing required field Principal"). I know I need to add "Principal": { "AWS": [ "my-account-num" ] }, but I just don't know where in the policy?  
  > **username_5**: @username_4 Try adding the policy directly to a user or to a user group instead of to the bucket itself.  
  
  ---
  
  ### Answer by username_1 on 2016-02-23. Score: 2
  
  I'm no AWS expert but does your iam user have the correct access/secret keys as well?
  
  While you're at it, you might as well grant PutObject, GetObject, and DeleteObject in that policy as well so Craft has access to the objects in it.
  
  See this [blog post](http://blogs.aws.amazon.com/security/post/Tx3VRSWZ6B3SHAV/Writing-IAM-Policies-How-to-grant-access-to-an-Amazon-S3-bucket) by Amazon for a good starting point.
  
  
  ---
  
  