I'm trying to get a basic upload bucket to work, but I'm having trouble trying to wrap my head around the bucket policy needed.
I currently have:
{
"Version": "2012-10-17",
"Statement": [
{
"Sid": "AddPerm",
"Effect": "Allow",
"Principal": "*",
"Action": "s3:*",
"Resource": "arn:aws:s3:::waydope-development/*",
"Condition": {
"StringEquals": {
"s3:x-amz-acl": "public-read"
}
}
}
]
}
The CORS are set to allow all. I can upload to this bucket by only supplying a key, but will this bucket if supplied with authorization, signature, and policy, return a 403 due to the fact that it is open? In other words, can I supply those keys without having the principal point at a user?
To see how a bucket policy relates to signing here is a question related to that: s3 how is the signature calculated
This is the minimum bucket policy where anyone can get, post, put, and delete an item in a bucket. All that is required in the formdata is the key - ie, file path.
Bucket Config:
{
"Version": "2012-10-17",
"Statement": [
{
"Sid": "AddPerm",
"Effect": "Allow",
"Principal": "*"
"Action": "s3:*",
"Resource": "arn:aws:s3:::example-development/*"
}
]
}
This is the minimum bucket policy where user/group authentication is required for anything besides get for the bucket upload.
Bucket Config:
{
"Version": "2012-10-17",
"Statement": [
{
"Sid": "Allow Get",
"Effect": "Allow",
"Principal": "*",
"Action": "s3:GetObject",
"Resource": "arn:aws:s3:::example-development/*"
},
{
"Sid": "AddPerm",
"Effect": "Allow",
"Principal": {
"AWS": "arn:aws:iam::123456789:user/example"
},
"Action": "s3:*",
"Resource": ["arn:aws:s3:::example-development/*","arn:aws:s3:::example-development"]
}
]
}