Access Denied for uploading images to AWS S3

Question

I am trying to upload images to my S3 Bucket. But I am receiving "AccessDenied: Access Denied at Request.extractError" error. The Dev NodeJS server is running in an EC2 Instance. Surprisingly, upload image functionality is working when I am running the server in localhost. Same credentials are being used in the local server and the dev server. And the IAM user has both administrator and AmazonS3FullAccess permissions.The S3 Bucket doesnt have any policy and the objects within the bucket can be public.

This is my NodeJS code for uploading an image.

const AWS = require('aws-sdk');
AWS.config.update({
  accessKeyId: process.env.AWS_ACCESS_KEY_ID,
  secretAccessKey: process.env.AWS_SECRET_ACCESS_KEY,
  region: process.env.AWS_REGION
});
const S3 = new AWS.S3();

uploadImage: async (title, file, mime) => {
    return await S3.upload({
        Bucket: process.env.AWS_S3_IMAGES,
        Key: title,
        Body: file,
        ACL: "public-read",
        ContentType: mime
    }).promise()
},

This is the error that I am receiving.

AccessDenied: Access Denied\n    at Request.extractError (/home/ec2-user/backend/node_modules/aws-sdk/lib/services/s3.js:700:35)\n    at Request.callListeners(/home/ec2-user/backend/node_modules/aws-sdk/lib/sequential_executor.js:106:20)\n    at Request.emit (/home/ec2-user/backend/node_modules/aws-sdk/lib/sequential_executor.js:78:10)\n    at Request.emit (/home/ec2-user/backend/node_modules/aws-sdk/lib/request.js:688:14)\n    at Request.transition (/home/ec2-user/backend/node_modules/aws-sdk/lib/request.js:22:10)\n    at AcceptorStateMachine.runTo (/home/ec2-user/backend/node_modules/aws-sdk/lib/state_machine.js:14:12)\n    at /home/ec2-user/backend/node_modules/aws-sdk/lib/state_machine.js:26:10\n    at Request. <anonymous> (/home/ec2-user/backend/node_modules/aws-sdk/lib/request.js:38:9)\n    at Request.<anonymous> (/home/ec2-user/backend/node_modules/aws-sdk/lib/request.js:690:12)\n    at Request.callListeners (/home/ec2-user/backend/node_modules/aws-sdk/lib/sequential_executor.js:116:18)\n    at Request.emit (/home/ec2-user/backend/node_modules/aws-sdk/lib/sequential_executor.js:78:10)\n    at Request.emit (/home/ec2-user/backend/node_modules/aws-sdk/lib/request.js:688:14)\n    at Request.transition (/home/ec2-user/backend/node_modules/aws-sdk/lib/request.js:22:10)\n    at AcceptorStateMachine.runTo (/home/ec2-user/backend/node_modules/aws-sdk/lib/state_machine.js:14:12)\n    at /home/ec2-user/backend/node_modules/aws-sdk/lib/state_machine.js:26:10\n    at Request.<anonymous> (/home/ec2-user/backend/node_modules/aws-sdk/lib/request.js:38:9)\n    at Request.<anonymous> (/home/ec2-user/backend/node_modules/aws-sdk/lib/request.js:690:12)\n    at Request.callListeners (/home/ec2-user/backend/node_modules/aws-sdk/lib/sequential_executor.js:116:18)\n    at callNextListener (/home/ec2-user/backend/node_modules/aws-sdk/lib/sequential_executor.js:96:12)\n    at IncomingMessage.onEnd (/home/ec2-user/backend/node_modules/aws-sdk/lib/event_listeners.js:313:13)\n    at IncomingMessage.emit (events.js:387:35)\n    at IncomingMessage.emit (domain.js:470:12)

I have been trying to solve this issue for the last few days But couldnt find any leads. It will be great if any one of you can point me in the right direction.

Thanks in advance.

Answer 1

Apply below policies in s3 console > Bucket policy editor of 'Permissions'.

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "editor",
            "Effect": "Allow",
            "Principal": {
                "AWS": "arn:aws:iam::<IAM-user-ID>:user/testuser"
            },
            "Action": [
                "s3:ListBucket",
                "s3:ListBucketVersions",
                "s3:GetBucketLocation",
                "s3:Get*",
                "s3:Put*",
                "s3:Delete*"
            ],
            "Resource": [
                "arn:aws:s3:::bucket/*",
                "arn:aws:s3:::bucket"
            ]
        },
        {
            "Sid": "editor2",
            "Effect": "Allow",
            "Action": "s3:ListAllMyBuckets",
            "Resource": "*"
        }
    ]
}