Necessary s3cmd S3 permissions for PUT/Sync

Question

In moving to AWS EC2, I want to restrict my instances' user permissions for good reason. One thing the instances need to do is access files on S3 and write files there. However, I cannot find any way to achieve this without giving all permissions to that user.

s3cmd allows me to call "ls" and "du" on the s3 buckets I gave the policy permission to, but always fails with a 403 error when trying to PUT/sync with one of these folders. If I use my root credentials, the transfer goes right through.

So, I don't get why if I give all permissions to the user for said buckets, it cannot PUT, but if I give it arn:aws:s3:::* (all buckets) then it can. Makes no sense to me.

Anyone else ever dealt with this before?

This is totally possible. What permissions have you given? – Frederick Cheung Jul 22 '12 at 20:22 — Frederick Cheung, Jul 22 '12 at 20:22

bwight · Accepted Answer · 2014-10-16T20:25:45.610

29

Try something like this. I think the problem is that you need s3:ListAllMyBuckets and s3:ListBuckets for the s3cmd to work. Not sure why but it wont work unless it can get a list of the buckets. I had the same problem the first time i tried to use permissions with s3cmd and this was the solution.

{
  "Statement": [
    {
      "Action": [
        "s3:ListAllMyBuckets"
      ],
      "Effect": "Allow",
      "Resource": "arn:aws:s3:::*"
    },
    {
      "Action": [ 
          "s3:ListBucket", 
          "s3:PutObject",
          "s3:PutObjectAcl"
      ],
      "Effect": "Allow",
      "Resource": [
          "arn:aws:s3:::bucket/path", 
          "arn:aws:s3:::bucket/path/*"
      ]
    }
  ]
}

Edit I've added the s3:PutObjectAcl action which is required for newer versions of s3cmd as stated by Will Jessop below.

edited Oct 16 '14 at 20:25

answered Jul 24 '12 at 14:30

bwight

3,300
17
21

2

I had the same problem as OP, and the part I was missing is the resource with the '/*' at the end. Without this, you can list but you can't put objects (403 error as OP said). – ColinM Nov 15 '13 at 17:32
3

s3cmd also needs s3:GetBucketLocation now. – Jeff Strunk Apr 10 '15 at 13:32
I was missing a wildcard on my bucket name: "arn:aws:s3:::bucket/path/*" adding this with these Actions did it for me – Kevin Hooke Jan 22 '18 at 02:16

score 4 · Answer 2 · answered Apr 18 '14 at 17:29

bwight's answer is almost right (it probably used to be for older versions of s3cmd), but I need to add a s3:PutObjectAcl to get it to work:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "Stmt123456",
      "Effect": "Allow",
      "Action": [
        "s3:ListAllMyBuckets"
      ],
      "Resource": [
        "arn:aws:s3:::*"
      ]
    },
    {
      "Sid": "Stmt123457",
      "Effect": "Allow",
      "Action": [
        "s3:ListBucket",
        "s3:PutObject",
        "s3:PutObjectAcl"
      ],
      "Resource": [
        "arn:aws:s3:::bucketname",
        "arn:aws:s3:::bucketname/*"
      ]
    }
  ]
}

Will update my answer based on this information. Thanks for the update. — bwight, Oct 16 '14 at 20:23

score 4 · Answer 3 · answered May 20 '15 at 13:52

I was trying to do big file uploads and the policy wasn't working well for me, I ended adding the next policy to the user:

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "Stmt1397834652000",
            "Effect": "Allow",
            "Action": [
                "s3:ListAllMyBuckets"
            ],
            "Resource": [
                "arn:aws:s3:::*"
            ]
        },
        {
            "Sid": "Stmt1397834745000",
            "Effect": "Allow",
            "Action": [
                "s3:ListBucket",
                "s3:ListBucketMultipartUploads",
                "s3:GetBucketLocation",
                "s3:AbortMultipartUpload",
                "s3:GetObjectAcl",
                "s3:GetObjectVersion",
                "s3:DeleteObject",
                "s3:DeleteObjectVersion",
                "s3:GetObject",
                "s3:PutObjectAcl",
                "s3:PutObject",
                "s3:GetObjectVersionAcl"
            ],
            "Resource": [
                "arn:aws:s3:::my_bucket",
                "arn:aws:s3:::my_bucket/*"
            ]
        }
    ]
}

where my_bucket is the bucket where I need to manage files though s3cmd

score 0 · Answer 4 · answered Feb 12 '18 at 13:44

In case you are giving access to a subfolder (as in the original answer of /bucket-name/path/) and not the entire bucket, the ListBucket action requires a bit more specificity:

{
    "Sid": "AllowListingOfFilesInFolder",
    "Effect": "Allow",
    "Action": [
        "s3:ListBucket"
    ],
    "Resource": [
        "arn:aws:s3:::bucket-name"
    ],
    "Condition": {
        "StringLike": {
            "s3:prefix": [
                "path/*"
            ]
        }
    }
}

I believe it works also with the original answer in case you provide access to the entire bucket.

Necessary s3cmd S3 permissions for PUT/Sync

4 Answers4

Linked