I am getting:
An error occurred (AccessDenied) when calling the ListObjects operation: Access Denied
When I try to get folder from my S3 bucket.
Using this command:
aws s3 cp s3://bucket-name/data/all-data/ . --recursive
The IAM permissions for the bucket look like this:
{
"Version": "version_id",
"Statement": [
{
"Sid": "some_id",
"Effect": "Allow",
"Action": [
"s3:*"
],
"Resource": [
"arn:aws:s3:::bucketname/*"
]
}
] }
What do I need to change to be able to copy
and ls
successfully?
You have given permission to perform commands on objects inside the S3 bucket, but you have not given permission to perform any actions on the bucket itself.
Slightly modifying your policy would look like this:
{
"Version": "version_id",
"Statement": [
{
"Sid": "some_id",
"Effect": "Allow",
"Action": [
"s3:*"
],
"Resource": [
"arn:aws:s3:::bucketname",
"arn:aws:s3:::bucketname/*"
]
}
]
}
However, that probably gives more permission than is needed. Following the AWS IAM best practice of Granting Least Privilege would look something like this:
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": [
"s3:ListBucket"
],
"Resource": [
"arn:aws:s3:::bucketname"
]
},
{
"Effect": "Allow",
"Action": [
"s3:GetObject"
],
"Resource": [
"arn:aws:s3:::bucketname/*"
]
}
]
}