required s3 permissions should be documented

[XertroV]

At least s3:PutObjectAcl is required (because I got access denied before that)

Sample policy which works:

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "s3:GetObject",
                "s3:GetObjectAcl",
                "s3:ListBucket",
                "s3:ListObjects",
                "s3:PutObject",
                "s3:PutObjectAcl"
            ],
            "Resource": [
                "arn:aws:s3:::<BUCKET_NAME>/*"
            ]
        }
    ]
}

[xcpep]

Thank you, this should definitely be added to the documentation.

[slorber]

Is this the error you got?

Cannot read property 'Key' of undefined

#27

Also, are you sure s3:ListObjects exists?

I get an error with this specific action (which I'd prefer to use because it does not use Docker and is faster), while another action is able to upload to s3 fine 😅

[slorber]

I'm using "s3:*" and it does not work either.

I believe this action fails because it tries to force public-read on the uploaded files, while I don't allow public reads on my bucket.

That may be worth it to make this optional

[XertroV]

re #21 (comment)

Looking at https://iam.cloudonaut.io/reference/s3.html, s3:ListObjects might not exist, not sure where I got that from.

---

re:

I believe this action fails because it tries to force public-read on the uploaded files, while I don't allow public reads on my bucket.

That sounds reasonable, but I can't test it via a bucket that explicitly disallows public-read atm.

[slorber]

So I can confirm, and my minimal bucket ACL looks like this to make this action work:

{
    "Version": "2012-10-17",
    "Id": "<ANY>",
    "Statement": [
        {
            "Sid": "<ANY>",
            "Effect": "Allow",
            "Principal": {
                "AWS": "<MY_ARN>"
            },
            "Action": [
                "s3:PutObject",
                "s3:PutObjectAcl"
            ],
            "Resource": "arn:aws:s3:::<MY_BUCKET>/*"
        },
        {
            "Effect": "Allow",
            "Principal": "*",
            "Action": "s3:GetObject",
            "Resource": "arn:aws:s3:::<MY_BUCKET>/*"
        }
    ]
}