S3 IAM policy for one bucket not granting access

Question

Can someone explain me why this policy doesn't work? What I want: full S3 control for the IAM user but limited to two buckets, defined by their ARNs. I always get Access Denied when trying to upload with AWS SDK from my server. Thank you

Answer 1

There are some possibilities here, it's hard to tell without seeing the full setup.

1. There is a bucket policy which explicitly denies the action
2. Bucket is encrypted and the user lacks KMS permissions
3. There is conflicting policy which takes precedence, like SCP policy. Try using https://policysim.aws.amazon.com/home/index.jsp , it's not 100% accurate but it can give a hint
4. You can also use CloudTrail to track all API calls made by user and determine which call failed

As an aside, you should be able to combine these policies by combining resources: Resource: ["arn_1", "arn_2"]