I've created a bucket to hold the log files created by the s3-log-service, and I've made the permissions so that the bucket can be both listed and the contents are publically accessible. I can list the contents of the bucket but web access to a log is denied with a 403 error.
{
"Version": "2008-10-17",
"Statement": [
{
"Sid": "AllowPublicRead",
"Effect": "Allow",
"Principal": {
"AWS": "*"
},
"Action": "s3:GetObject",
"Resource": "arn:aws:s3:::mybucket/*"
},
{
"Sid": "AllowPublicRead",
"Effect": "Allow",
"Principal": {
"AWS": "*"
},
"Action": "s3:ListBucket",
"Resource": "arn:aws:s3:::mybucket"
}
]
}
I gather such a policy doesn't work when the object (log file) is owned by someone else.
So, what other permissions do I need to apply to the bucket contents to make them publically accessible?
You're correct in saying that the bucket policy does not apply to objects not owned by the AWS account. You have 2 options:
public-read:AWS_ACCESS_KEY_ID=XXX \
AWS_SECRET_ACCESS_KEY=XXX \
aws s3 cp \
s3://BUCKET/OBJECT_PATH \
s3://BUCKET/OBJECT_PATH \
--acl public-read
bucket-owner-full-control. From there, the bucket policy take over objects' permissions.The only way I found to do either option (without getting access denied errors) is to use the AWS account root user's credentials.