45

I have a windows machine that need to sync a folder with S3.

I try

"C:\Program Files\amazon\AWSCLI\aws.exe" s3 sync components 
s3://test/MyTest/ --acl public-read --
cache-control "public, must-revalidate, proxy-revalidate, max-age=1800"

got error "A client error (AccessDenied) occurred when calling the PutObject operation: Access Denied"

s3 rm and s3 cp for the same directory works fine.

I have the following permissions :

"Sid": "VisualEditor4",
            "Effect": "Allow",
            "Action": [
                "s3:PutObject",
                "s3:PutObjectAcl"
            ],
            "Resource":  
0

2 Answers 2

48

You need all this actions:

  • s3:DeleteObject
  • s3:GetBucketLocation
  • s3:GetObject
  • s3:ListBucket
  • s3:PutObject

Not only PutObject, for get work S3 Sync, use this policy:

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Resource": [
                "arn:aws:s3:::YOUR_BUCKET_NAME",
                "arn:aws:s3:::YOUR_BUCKET_NAME/*"
            ],
            "Sid": "Stmt1464826210000",
            "Effect": "Allow",
            "Action": [
                "s3:DeleteObject",
                "s3:GetBucketLocation",
                "s3:GetObject",
                "s3:ListBucket",
                "s3:PutObject"
            ]
        }
    ]
}
6
  • 6
    You'll also need to add permission for the s3:PutObjectAcl action Aug 3, 2020 at 9:34
  • 3
    I also needed to add ListObjects for sync Dec 7, 2020 at 22:11
  • 1
    @robert-dundon There is no such s3: ListObjects action.. I think you are confusing IAM action with API action, see docs.aws.amazon.com/AmazonS3/latest/API/API_ListObjects.html
    – Yves M.
    Mar 3, 2021 at 8:16
  • @YvesM. Ha! Yes, probably. In that case, I was using AWS CLI so that makes sense. Also to note in that link, ListObjectsV2 is recommended now. Mar 3, 2021 at 15:45
  • 1
    Why would we need "s3:GetObject" and "s3:GetBucketLocation". I've setup our servers to backup to subfolders in a bucket and I've only given "s3:DeleteObject", "s3:ListBucket" and "s3:PutObject".
    – Sasse
    Apr 11, 2022 at 8:00
7

Synchronizing files also requires READ permissions because the AWS Command-Line Interface (CLI) needs to view the existing files to determine whether they already exist or have been modified.

Thus, you will also need to grant ListBucket permission.

If you use aws s3 cp instead of aws s3 sync, then this is not required.

0

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.