amazon web services - AWS S3: can't list the bucket after change of policy -
we have created bucket in aws s3 , iam-user specific policy restrict access bucket follows:
bucket: testbucket
policy:
{ "version": "2012-10-17", "statement": [ { "effect": "allow", "action": [ "s3:getobject", "s3:getobjectacl", "s3:getobjectversion", "s3:putobject", "s3:putobjectacl", "s3:putobjectversionacl" ], "resource": [ "arn:aws:s3:::testbucket/*", ] } ] }
then we've created iam-user , assigned policy permissions of user. got access-key , secret-access-key , can upload files bucket , download them given, known url resources.
now want able list objects in bucket. therefor have changed policy way:
new policy:
{ "version": "2012-10-17", "statement": [ { "effect": "allow", "action": [ "s3:getobject", "s3:getobjectacl", "s3:getobjectversion", "s3:putobject", "s3:putobjectacl", "s3:putobjectversionacl" ], "resource": [ "arn:aws:s3:::testbucket/*", ] }, { "effect": "allow", "action": [ "s3:listbucket" ], "resource": [ "arn:aws:s3:::testbucket/*" ] } ] }
the new item here s3:listbucket
.
i have changed policy , can reload page on aws ensure these changes still existing.
however, i've waited hour still unable list objects of bucket.
for testing use app cyberduck. can list bucket after authentication still can't list objects in bucket.
do need else?
s3:listbucket applies bucket, not objects within it. therefore, second statement must not have trailing slash , wildcard , should be:
{ "effect": "allow", "action": [ "s3:listbucket" ], "resource": [ "arn:aws:s3:::testbucket" ] }
Comments
Post a Comment