Not sure why this aws s3 bucket policy isn't working?

Question

I have created a user called user1 and a role called s3limitedaccess and attached this bucket policy below. Created an access and secret key for this user, but cannot get this user to see this bucket or do anything with it. Please can someone advise. Thanks

Code:

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "Stmt1499888918000",
            "Effect": "Allow",
            "Action": [
                "s3:*"
            ],
            "Resource": [
                "arn:aws:s3:::rscexternal/*"
            ]
        }
    ]
}

Answer 1

If you wish to assign permissions to a specific IAM User, IAM Group or IAM Role, you should assign the permissions directly against that User/Group/Role within IAM rather than creating a Bucket Policy . (This might be what you did, but you mentioned "bucket policy" so it is unclear.)

Some Amazon S3 API calls operate at the bucket-level (eg listing the bucket) and some operate at the object-level (eg GetObject). Therefore, you would need a policy that grants access to both:

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "GrantFullAccess",
            "Effect": "Allow",
            "Action": [
                "s3:*"
            ],
            "Resource": [
                "arn:aws:s3:::rscexternal",
                "arn:aws:s3:::rscexternal/*"
            ]
        }
    ]
}

The IAM User with the above policy should then be able to access the bucket . For example, using the AWS Command-Line Interface (CLI) :

aws s3 ls s3://rscexternal

If you wish the user to be able to use Amazon S3 via the management console , additional permissions are required.

From Policy for Console Access :

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "s3:GetBucketLocation",
        "s3:ListAllMyBuckets"
      ],
      "Resource": "arn:aws:s3:::*"
    },
    {
      "Effect": "Allow",
      "Action": ["s3:ListBucket"],
      "Resource": ["arn:aws:s3:::test"]
    },
    {
      "Effect": "Allow",
      "Action": [
        "s3:PutObject",
        "s3:GetObject",
        "s3:DeleteObject"
      ],
      "Resource": ["arn:aws:s3:::test/*"]
    }
  ]
}