Jenkins拒绝了S3存取桶访问

Question

I am trying to upload build files from Jenkins to S3 Bucket. I wanted only Cloudfront & the user deployer to have access to the bucket, the policy is as follows:

{
    "Version": "2008-10-17",
    "Id": "PolicyForCloudFrontPrivateContent",
    "Statement": [
        {
            "Sid": "1",
            "Effect": "Allow",
            "Principal": {
                "AWS": "arn:aws:iam::cloudfront:user/CloudFront Origin Access Identity XXXXXXXXXX"
            },
            "Action": "s3:GetObject",
            "Resource": "arn:aws:s3:::samplebucket/*"
        },
        {
            "Sid": "2",
            "Effect": "Allow",
            "Principal": {
                "AWS": [
                    "arn:aws:iam::1234567890:user/deployer"
                ]
            },
            "Action": [
                "s3:*"
            ],
            "Resource": [
                "arn:aws:s3:::samplebucket",
                "arn:aws:s3:::samplebucket/*"
            ]
        }
    ]
}

This policy is not allowing the deployer to upload objects to S3. Whereas if i set the bucket access to public, i am able to successfully upload the objects from Jenkins. I don't want my buckets to be public.

Answer 1

I am using a user with Access Key and Secret Key to access the bucket with full permissions, but checked Use IAM Role in Jenkins -> Configure System -> Amazon S3 Profiles. Just uncheck , you are good to go. Probably i need to check it only when using a role.