Body: <p>I'm hosting assets for Craft 2.9.3 site on AWS S3.</p>
  <p>I'm trying to figure out how to give the site (and its users) access to the files without making them broadly publicly available.</p>
  <p>I found a suggestion for the right User/Group permissions <a href="https://craftcms.stackexchange.com/q/13815/10913">here</a>. Those are:</p>
  <pre><code>{
  &quot;Version&quot;: &quot;2012-10-17&quot;,
  &quot;Statement&quot;: [
      {
          &quot;Effect&quot;: &quot;Allow&quot;,
          &quot;Action&quot;: [
              &quot;s3:ListAllMyBuckets&quot;
          ],
          &quot;Resource&quot;: &quot;*&quot;
      },
      {
          &quot;Effect&quot;: &quot;Allow&quot;,
          &quot;Action&quot;: [
              &quot;s3:GetBucketLocation&quot;,
              &quot;s3:ListBucket&quot;,
              &quot;s3:PutObject&quot;,
              &quot;s3:GetObject&quot;,
              &quot;s3:DeleteObject&quot;,
              &quot;s3:GetObjectAcl&quot;,
              &quot;s3:PutObjectAcl&quot;
          ],
          &quot;Resource&quot;: [
              &quot;arn:aws:s3:::bucketname/*&quot;
          ]
      },
      {
          &quot;Effect&quot;: &quot;Allow&quot;,
          &quot;Action&quot;: [
              &quot;s3:GetBucketLocation&quot;,
              &quot;s3:ListBucket&quot;
          ],
          &quot;Resource&quot;: [
              &quot;arn:aws:s3:::bucketname&quot;
          ]
      }
  ]
  }
  </code></pre>
  <p>I attached this policy to an IAM Group, in which the IAM User is a member. I am using that IAM User's credentials on Craft 2 for access to the files.</p>
  <p>However, I get a 'Access denied&quot; error. The only way I've found to get rid of that error is to grant full public access to the bucket. It doesn't seem right to me that the files are publicly accessible. On the site itself only logged in users have access to many of the assets in the S3 bucket.</p>
  <p>Have I missed a step somewhere in this configuration?</p>
  <h3>UPDATE 20201020</h3>
  <p>I tried a User policy generated by the tool Billythekid provided in the comments. The policy it created was:</p>
  <pre><code>{
    &quot;Version&quot;: &quot;2012-10-17&quot;,
    &quot;Statement&quot;: [
      {
        &quot;Effect&quot;: &quot;Allow&quot;,
        &quot;Action&quot;: &quot;s3:ListAllMyBuckets&quot;,
        &quot;Resource&quot;: &quot;arn:aws:s3:::*&quot;
      },
      {
        &quot;Effect&quot;: &quot;Allow&quot;,
        &quot;Action&quot;: [
          &quot;s3:ListBucket&quot;,
          &quot;s3:ListBucketMultipartUploads&quot;,
          &quot;s3:GetBucketLocation&quot;
        ],
        &quot;Resource&quot;: &quot;arn:aws:s3:::MY-BUCKET&quot;
      },
      {
        &quot;Effect&quot;: &quot;Allow&quot;,
        &quot;Action&quot;: [
          &quot;s3:AbortMultipartUpload&quot;,
          &quot;s3:DeleteObject&quot;,
          &quot;s3:GetObjectAcl&quot;,
          &quot;s3:GetObject&quot;,
          &quot;s3:PutObjectAcl&quot;,
          &quot;s3:PutObject&quot;
        ],
        &quot;Resource&quot;: &quot;arn:aws:s3:::MY-BUCKET/*&quot;
      }
    ]
  }
  </code></pre>
  <p>After applying this policy to the User, I still get <code>AccessDenied</code> error from AWS when trying to access the file from the site. Yet when I run the appropriate tests in the IAM Policy Simulator, everything is accessible as expected.</p>
  <p>The only way I've found around this is to set a policy on the bucket which grants public access (e.g., a policy that has <code>&quot;Principle&quot;: &quot;*&quot;</code> field/value in it, along with the necessary actions, etc.</p>
  <p>As a workaround, I've set a <code>aws:Referrer</code> condition, so that only the site in question can reference the files.</p>
  <p>So I am back to my original question ... How does one set up AWS S3 for Craft without granting public access to the bucket? For example, I don't have this issue when I give Wordpress storage plug-ins AWS S3 storage access (i.e., public access is blocked, and Wordpress doesn't get an <code>access denied</code> error from AWS.</p>
  
Comments.ContentLicense: CC BY-SA 4.0
Comments.CreationDate: 2020-07-10T07:44:01.780Z
Comments.Text: I made a little thing for my access policy for craft: https://craft.btk.scot
Comments.UserDisplayName: billythekid
Comments.ContentLicense: CC BY-SA 4.0
Comments.CreationDate: 2020-07-10T15:40:38.153Z
Comments.Text: What are you doing when you get the Access Denied error?  Are you trying to embed them onto a website or what's your use case?
Comments.UserDisplayName: RitterKnight
Comments.ContentLicense: CC BY-SA 4.0
Comments.CreationDate: 2020-07-10T17:01:16.493Z
Comments.Text: @ritterknight I am selecting an asset in the back end and click the view asset option.
Comments.UserDisplayName: inspirednz
Comments.ContentLicense: CC BY-SA 4.0
Comments.CreationDate: 2020-10-20T04:00:43.427Z
Comments.Text: Anyone? Has no one else got AWS S3 set up on their Craft site?
Comments.UserDisplayName: inspirednz
Comments.ContentLicense: CC BY-SA 4.0
Comments.CreationDate: 2020-10-20T04:14:41.847Z
Comments.Text: @billythekid Thanks for this link/tool Billy. I tried the resulting policy. I had to add in the `"Principal": "*"` field, as AWS wouldn't let me save without it. I also had to remove the section for `      "Action": "s3:ListAllMyBuckets",` as I don't want this site having the ability to list all buckets on my AWS account. I don't think either or these changes should be an issue. However, the end result is still an `Access Denied` error (after I enable "Block all public access" on the Bucket. Any suggestions?
Comments.UserDisplayName: inspirednz
Comments.ContentLicense: CC BY-SA 4.0
Comments.CreationDate: 2020-10-20T18:59:38.300Z
Comments.Text: @inspirednz I've never been able to get that to work. unfortunately all sites under my account list all buckets. It never used to do that in Craft2, just when the S3 went to the plugin out of core. FWIW my buckets are not public either, but items "can be" public, which IIRC is a setting when setting up the bucket.
Comments.UserDisplayName: billythekid
Comments.ContentLicense: CC BY-SA 4.0
Comments.CreationDate: 2020-10-21T02:33:50.630Z
Comments.Text: @billythekid - actually, sorry, I see I put Craft 3 in my post. It's actually v2.9.3. In case that makes any difference. Your tool didn't provide for the `Principle` field. How are you getting around that? I had to add in that field, and I added in wildcard value `"*"`, but that then opens the bucket to the public. How did you get around that?
Comments.UserDisplayName: inspirednz
Comments.ContentLicense: CC BY-SA 4.0
Comments.CreationDate: 2020-10-21T03:17:12.623Z
Comments.Text: It sounds like you're trying to apply the policy to the bucket but you want to apply it to the IAM user that is accessing the bucket. We generally create a special IAM user that is only used by Craft to access the bucket. This user gets a policy very similar to the one in your answer. The bucket shouldn't need a policy.
Comments.UserDisplayName: brianjhanson
Comments.ContentLicense: CC BY-SA 4.0
Comments.CreationDate: 2020-10-21T03:29:02.907Z
Comments.Text: @brianjhanson - Thanks Brian. To clarify, I added the policy to the User, and have applied that user's credentials in the S3 settings on Craft 2 site. But that has no effect. Very frustrating. The only way I can get rid of the AccessDenied error is to open the bucket up (to the public, in effect) on with a bucket policy that has `Principle: *`. I can only conclude there's something wrong with the S3 implementation in Craft 2, or there's something else I am over-looking.
Comments.UserDisplayName: inspirednz
Comments.ContentLicense: CC BY-SA 4.0
Comments.CreationDate: 2020-10-21T03:46:03.280Z
Comments.Text: @brianjhanson - further to above comment: When I run the policy simulator it shows the User policy works fine for accessing the bucket, etc. Yet Craft 2, with that user's credentials, gets `AccessDenied`. I think there has to be a bug in the S3 implementation in Craft 2.9.2.
Comments.UserDisplayName: inspirednz
Comments.ContentLicense: CC BY-SA 4.0
Comments.CreationDate: 2020-10-22T14:49:36.827Z
Comments.Text: @inspirednz looks like Craft 2.9.2 is using this script as at least part of the S3 implementation https://github.com/tpyo/amazon-s3-php-class. You could try monkey patching it by replacing that file within the Craft repo here https://github.com/craftcms/cms/blob/2.9.2/src/lib/S3.php to see if that fixes it. Looks like at least one bug fix has been issued since Craft pulled it in, but it also doesn't seem to be actively maintained.
Comments.UserDisplayName: brianjhanson
Tags: <assets><s3><aws>
Title: What's the recommended permissions configuration for AWS S3 media storage?
ThreadText: # What's the recommended permissions configuration for AWS S3 media storage?
  
  (Asked by: username_0 on 2020-07-10)
  
  I'm hosting assets for Craft 2.9.3 site on AWS S3.
  
  I'm trying to figure out how to give the site (and its users) access to the files without making them broadly publicly available.
  
  I found a suggestion for the right User/Group permissions [here](https://craftcms.stackexchange.com/q/13815/10913). Those are:
  
  ```
  {
  "Version": "2012-10-17",
  "Statement": [
      {
          "Effect": "Allow",
          "Action": [
              "s3:ListAllMyBuckets"
          ],
          "Resource": "*"
      },
      {
          "Effect": "Allow",
          "Action": [
              "s3:GetBucketLocation",
              "s3:ListBucket",
              "s3:PutObject",
              "s3:GetObject",
              "s3:DeleteObject",
              "s3:GetObjectAcl",
              "s3:PutObjectAcl"
          ],
          "Resource": [
              "arn:aws:s3:::bucketname/*"
          ]
      },
      {
          "Effect": "Allow",
          "Action": [
              "s3:GetBucketLocation",
              "s3:ListBucket"
          ],
          "Resource": [
              "arn:aws:s3:::bucketname"
          ]
      }
  ]
  }
  
  ```
  
  I attached this policy to an IAM Group, in which the IAM User is a member. I am using that IAM User's credentials on Craft 2 for access to the files.
  
  However, I get a 'Access denied" error. The only way I've found to get rid of that error is to grant full public access to the bucket. It doesn't seem right to me that the files are publicly accessible. On the site itself only logged in users have access to many of the assets in the S3 bucket.
  
  Have I missed a step somewhere in this configuration?
  
  ### UPDATE 20201020
  
  I tried a User policy generated by the tool username_1 provided in the comments. The policy it created was:
  
  ```
  {
    "Version": "2012-10-17",
    "Statement": [
      {
        "Effect": "Allow",
        "Action": "s3:ListAllMyBuckets",
        "Resource": "arn:aws:s3:::*"
      },
      {
        "Effect": "Allow",
        "Action": [
          "s3:ListBucket",
          "s3:ListBucketMultipartUploads",
          "s3:GetBucketLocation"
        ],
        "Resource": "arn:aws:s3:::MY-BUCKET"
      },
      {
        "Effect": "Allow",
        "Action": [
          "s3:AbortMultipartUpload",
          "s3:DeleteObject",
          "s3:GetObjectAcl",
          "s3:GetObject",
          "s3:PutObjectAcl",
          "s3:PutObject"
        ],
        "Resource": "arn:aws:s3:::MY-BUCKET/*"
      }
    ]
  }
  
  ```
  
  After applying this policy to the User, I still get `AccessDenied` error from AWS when trying to access the file from the site. Yet when I run the appropriate tests in the IAM Policy Simulator, everything is accessible as expected.
  
  The only way I've found around this is to set a policy on the bucket which grants public access (e.g., a policy that has `"Principle": "*"` field/value in it, along with the necessary actions, etc.
  
  As a workaround, I've set a `aws:Referrer` condition, so that only the site in question can reference the files.
  
  So I am back to my original question ... How does one set up AWS S3 for Craft without granting public access to the bucket? For example, I don't have this issue when I give Wordpress storage plug-ins AWS S3 storage access (i.e., public access is blocked, and Wordpress doesn't get an `access denied` error from AWS.
  
  **Tags:** assets, s3, aws
  
  > **Comments:**
  > **username_1**: I made a little thing for my access policy for craft: https://craft.btk.scot  
  > **username_2**: What are you doing when you get the Access Denied error?  Are you trying to embed them onto a website or what's your use case?  
  > **username_0**: @username_2 I am selecting an asset in the back end and click the view asset option.  
  > **username_0**: Anyone? Has no one else got AWS S3 set up on their Craft site?  
  > **username_0**: @username_1 Thanks for this link/tool Billy. I tried the resulting policy. I had to add in the `"Principal": "*"` field, as AWS wouldn't let me save without it. I also had to remove the section for `      "Action": "s3:ListAllMyBuckets",` as I don't want this site having the ability to list all buckets on my AWS account. I don't think either or these changes should be an issue. However, the end result is still an `Access Denied` error (after I enable "Block all public access" on the Bucket. Any suggestions?  
  > **username_1**: @username_0 I've never been able to get that to work. unfortunately all sites under my account list all buckets. It never used to do that in Craft2, just when the S3 went to the plugin out of core. FWIW my buckets are not public either, but items "can be" public, which IIRC is a setting when setting up the bucket.  
  > **username_0**: @username_1 - actually, sorry, I see I put Craft 3 in my post. It's actually v2.9.3. In case that makes any difference. Your tool didn't provide for the `Principle` field. How are you getting around that? I had to add in that field, and I added in wildcard value `"*"`, but that then opens the bucket to the public. How did you get around that?  
  > **username_3**: It sounds like you're trying to apply the policy to the bucket but you want to apply it to the IAM user that is accessing the bucket. We generally create a special IAM user that is only used by Craft to access the bucket. This user gets a policy very similar to the one in your answer. The bucket shouldn't need a policy.  
  > **username_0**: @username_3 - Thanks Brian. To clarify, I added the policy to the User, and have applied that user's credentials in the S3 settings on Craft 2 site. But that has no effect. Very frustrating. The only way I can get rid of the AccessDenied error is to open the bucket up (to the public, in effect) on with a bucket policy that has `Principle: *`. I can only conclude there's something wrong with the S3 implementation in Craft 2, or there's something else I am over-looking.  
  > **username_0**: @username_3 - further to above comment: When I run the policy simulator it shows the User policy works fine for accessing the bucket, etc. Yet Craft 2, with that user's credentials, gets `AccessDenied`. I think there has to be a bug in the S3 implementation in Craft 2.9.2.  
  > **username_3**: @username_0 looks like Craft 2.9.2 is using this script as at least part of the S3 implementation https://github.com/tpyo/amazon-s3-php-class. You could try monkey patching it by replacing that file within the Craft repo here https://github.com/craftcms/cms/blob/2.9.2/src/lib/S3.php to see if that fixes it. Looks like at least one bug fix has been issued since Craft pulled it in, but it also doesn't seem to be actively maintained.  
  
  ---
  
  ## 0 answers
  
  