0

I have the following bucket policy for Amazon S3, which is giving the following error:

Error: Invalid bucket policy syntax.

Either it is a JSON syntax error or a Policy error.

This is the policy I am trying and failing with:

{
    "Version": "2012-10-17",
    "Statement": [{
        "Effect": "Allow",
        "Action": [
            "s3:ListBucket",
            "s3:GetBucketLocation",
            "s3:ListBucketMultipartUploads"
        ],
        "Resource": "arn:aws:s3:::<my bucket>",
        "Principal": {
            "AWS": [
                "arn:aws:iam::560184616970:user/<my username>"
            ]
        },
        "Statement": [{
            "Effect": "Allow",
            "Action": [
                "s3:AbortMultipartUpload",
                "s3:DeleteObject",
                "s3:DeleteObjectVersion",
                "s3:GetObject",
                "s3:GetObjectAcl",
                "s3:GetObjectVersion",
                "s3:GetObjectVersionAcl",
                "s3:PutObject",
                "s3:PutObjectAcl",
                "s3:PutObjectAclVersion"
            ],
            "Resource": "arn:aws:s3:::<my-bucket>/*",
            "Principal": {
                "AWS": [
                    "arn:aws:iam::560184616970:user/<my-username>"
                ]
            },
            "Statement": [{
                "Effect": "Allow",
                "Action": "s3:ListAllMyBuckets",
                "Resource": "*"
            }]
        }]
    }]
}

Can anyone give me guidance here?

1

It looks like you tried to compile multiple policies into one.
Each original had a statement with its array of statements and you nested them.

This (untested) should work with each statement block within the array of Statement of the policy:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "s3:ListBucket",
        "s3:GetBucketLocation",
        "s3:ListBucketMultipartUploads"
      ],
      "Resource": "arn:aws:s3:::<my bucket>",
      "Principal": {
        "AWS": [
          "arn:aws:iam::560184616970:user/<my username>"
        ]
      }
    },
    {
      "Effect": "Allow",
      "Action": [
        "s3:AbortMultipartUpload",
        "s3:DeleteObject",
        "s3:DeleteObjectVersion",
        "s3:GetObject",
        "s3:GetObjectAcl",
        "s3:GetObjectVersion",
        "s3:GetObjectVersionAcl",
        "s3:PutObject",
        "s3:PutObjectAcl",
        "s3:PutObjectAclVersion"
      ],
      "Resource": "arn:aws:s3:::<my-bucket>/*",
      "Principal": {
        "AWS": [
          "arn:aws:iam::560184616970:user/<my-username>"
        ]
      }
    },
    {
      "Effect": "Allow",
      "Action": "s3:ListAllMyBuckets",
      "Resource": "*"
    }
  ]
}

An alternative could be to use aws bucket policy generator

  • I did use the Policy generator and did not realize that each Statement block was a separate policy. Using the example provided I am getting Error: Missing required field Principal. And if I add a Principal to the last section I then I get Error: Policy has invalid action. – fndtn357 Oct 30 at 10:42
  • I'll move this to the Amazon support forums - I did create a policy that validates but allows public access from the website URL and Amazon complains about Public Access. Thanks for your help. – fndtn357 Oct 30 at 10:55

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.