Create AWS Access Policy to Only 1 S3 Bucket

Question

I'm trying to create a policy that allows access to only 1 bucket for our clients' WordPress backups using BackWPUp

This is after noticing that the default S3 Full Access policy allows full access to ALL buckets!

I tried following this article here: https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_examples_s3_rw-bucket-console.html

The policy looks like this (replaced the bucket name to an appropriate one) and it's not working:

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "ConsoleAccess",
            "Effect": "Allow",
            "Action": [
                "s3:GetAccountPublicAccessBlock",
                "s3:GetBucketAcl",
                "s3:GetBucketLocation",
                "s3:GetBucketPolicyStatus",
                "s3:GetBucketPublicAccessBlock",
                "s3:ListAllMyBuckets"
            ],
            "Resource": "*"
        },
        {
            "Sid": "ListObjectsInBucket",
            "Effect": "Allow",
            "Action": "s3:ListBucket",
            "Resource": ["arn:aws:s3:::bucket-name"]
        },
        {
            "Sid": "AllObjectActions",
            "Effect": "Allow",
            "Action": "s3:*Object",
            "Resource": ["arn:aws:s3:::bucket-name/*"]
        }
    ]
}

Receiving Error: S3 Service API: Access Denied

Then, I tried a simplified version:

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "PolicyID",
            "Effect": "Allow",
            "Action": [
                "s3:*"
            ],
            "Resource": [
                "arn:aws:s3:::bucket-name/*"
            ]
        }
    ]
}

Still no luck, with the same error. Any ideas? What am I missing?

Answer 1

Turns out I needed s3:ListBucketMultipartUploads and s3:GetBucketLocation to get it working properly.

Final version below:

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "s3:ListBucket",
                "s3:GetBucketLocation",
                "s3:ListBucketMultipartUploads"
            ],
            "Resource": "arn:aws:s3:::bucket-name"
        },
        {
            "Effect": "Allow",
            "Action": "s3:*"
            "Resource": "arn:aws:s3:::bucket-name/*"
        }
    ]
}