Django/AWS - 调用 HeadObject 操作时发生错误（403）：禁止

Question

I'm trying to set up my Django project to host static images on AWS S3 buckets, but when I try to upload an image via the Django admin panel I get the following error

These are my settings in Django

AWS_ACCESS_KEY_ID = 'some_key' 
AWS_SECRET_ACCESS_KEY = 'some_key_aswell' 
AWS_STORAGE_BUCKET_NAME = 'bucket_name'

AWS_S3_FILE_OVERWRITE = False
AWS_DEFAULT_ACL = None
DEFAULT_FILE_STORAGE = 'storages.backends.s3boto3.S3Boto3Storage'

AWS_S3_REGION_NAME = 'us-east-2' 

Cors policy setup for the bucket

 [
    {
        "AllowedHeaders": [
            "*"
        ],
        "AllowedMethods": [
            "GET",
            "POST",
            "PUT"
        ],
        "AllowedOrigins": [
            "*"
        ],
        "ExposeHeaders": []
    }
]

Answer 1

The IAM role used by the machine (or container) on which your Django app runs needs the following IAM policy added:

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
              "s3:GetObject",
            ],
            "Resource": "arn:aws:s3:::<bucket>/<prefix>/*"
        }
    ]
}

If your object is encypted, make sure that you also allow your IAM role to use the KMS key used to encrypt your object.

Answer 2

I went over and changed the Bucket policy to this:

{
    "Version": "2008-10-17",
    "Statement": [
        {
            "Sid": "AllowPublicRead",
            "Effect": "Allow",
            "Principal": {
                "AWS": "*"
            },
            "Action": "s3:GetObject",
            "Resource": "arn:aws:s3:::YOUR-BUCKET-NAME/*"
        }
    ]
}

And it worked.