AWS s3 bucket policy invalid group principal

amazon-web-services amazon-s3 amazon-iam
HoaxKey picture HoaxKey · Jun 12, 2013 · Viewed 8.9k times · Source

This is a follow on from How can i enforce file type uploads with an AWS S3 bucket policy

When applying the bucket policy:

{
  "Version":"2008-10-17",
  "Statement": [
    {
      "Sid":"AddPerm",
      "Effect":"Allow",
      "Principal": { "AWS": "arn:aws:iam::111122223333:group/admins" },
      "Action": "s3:PutObject",
      "Resource": "arn:aws:s3:::bucket/*.txt"
    }
  ]
}

The group "admins" definitely exists, but I get the error: "Invalid principal in policy - "AWS" : "arn:aws:iam::111122223333:group/admins""

Why is it not recognised?

Answer

yegor256 picture yegor256 · Jun 12, 2013

It's not possible to use groups in Principal at the moment. See https://forums.aws.amazon.com/message.jspa?messageID=356160

Related questions

AWS create role - Has prohibited field

I am trying out a simple example suggested by AWS documentation to create a role using a policy json file http://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_create_for-service.html And I get the error A client …

Read More
aws lambda function getting access denied when getObject from s3

I am getting an acccess denied error from S3 AWS service on my Lambda function. This is the code: // dependencies var async = require('async'); var AWS = require('aws-sdk'); var gm = require('gm').subClass({ imageMagick: true }); // Enable ImageMagick integration. exports.handler = …

Read More
How enable access to AWS STS AssumeRole

I am getting an error when calling to assume role method of STS. It says that the user is not authorized to perform sts:AsumeRole on resource xxx. I did the following: I created a role to access to S3 …

Read More