Unable to create access key for AWS S3 data transfer

Question

I recently started using AWS S3 Bucket and facing some issues as I would like to transfer the files from S3 bucket to another server using Boto I Python.

When I tried creating access key and secret key for API, access I got an error that I do not have the permissions to create access key.

I am trying to change the policy as shown below but getting an error:

{
    "Version": "2008-10-17",
    "Statement": [
        {
            "Sid": "AllowPublicRead",
            "Effect": "Allow",
            "Principal": {
                "AWS": "*"
            },
            "Action": "s3:GetObject",
            "Resource": "arn:aws:s3:::s3-sample/*"
        },
        {
            "Sid": "ViewAndUpdateAccessKeys",
            "Effect": "Allow",
            "Principal": {
                "AWS": "*"
            },
            "Action": [
                "iam:UpdateAccessKey",
                "iam:CreateAccessKey",
                "iam:ListAccessKeys"
            ],
            "Resource": "arn:aws:iam::*:user/${aws:username}"
        }
        
    ]
}

This leads to the following error:

Policy has invalid action

Can someone point to how to set the policy correctly so that it would enable creation of API access keys as well as transfer of files to another server?

Thank you.

Answer 1

IAM identity-Based Policies don't have principles. They principle will be deduced automatically when you attach the policy to IAM user, role or group.

However, it seems to me that you are creating bucket policies , which have the principle. However, bucket policies do not apply to iam:* permissions. This would explain your error.

Therefore, I think you should leave your bucket policy in its original state:

{
    "Version": "2008-10-17",
    "Statement": [
        {
            "Sid": "AllowPublicRead",
            "Effect": "Allow",
            "Principal": {
                "AWS": "*"
            },
            "Action": "s3:GetObject",
            "Resource": "arn:aws:s3:::s3-sample/*"
        }        
    ]
}

and create IAM customer managed policy which you can attach to the IAM user who requires it:

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "ViewAndUpdateAccessKeys",
            "Effect": "Allow",
            "Action": [
                "iam:UpdateAccessKey",
                "iam:CreateAccessKey",
                "iam:ListAccessKeys"
            ],
            "Resource": "arn:aws:iam::*:user/${aws:username}"
        }
    ]
}