Why do I get Access denied on s3 asset source images? I have created an s3 bucket in aws and added the correct permissions and user group etc. I have added the below policy:

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "VisualEditor0",
            "Effect": "Allow",
            "Action": [
                "s3:PutObject",
                "s3:GetObjectAcl",
                "s3:GetObject",
                "s3:ListAllMyBuckets",
                "s3:ListBucket",
                "s3:DeleteObject",
                "s3:GetBucketLocation",
                "s3:PutObjectAcl"
            ],
            "Resource": "*"
        },
        {
            "Sid": "VisualEditor1",
            "Effect": "Allow",
            "Action": [
                "s3:ListBucket",
                "s3:GetBucketLocation"
            ],
            "Resource": "arn:aws:s3:::bucketname"
        }
    ]
}


I uploaded the assets from a local folder via ftp to the bucket using transmit ftp client which was fine. I have then set the bucket up on craft cms as an asset source. I can upload files to s3 via the cms fine with no issues and view the image fine but when I try to access an image on the front end that was uploaded via the ftp I get access denied error 403:

&lt;Error&gt;
&lt;Code&gt;AccessDenied&lt;/Code&gt;
&lt;Message&gt;Access Denied&lt;/Message&gt;
&lt;RequestId&gt;96E15AB155C47209&lt;/RequestId&gt;
&lt;HostId&gt;
our-hist-id-here
&lt;/HostId&gt;
&lt;/Error&gt;


edit here

So after some research I found out that you needed to add the policy directly to the bucket. You used to have to create a policy away from the bucket page itself in the IAM area but now(I think) it needs to be in the bucket.

Is this a policy issue?

Thanks
I'm not really an AWS expert, but I think if you want to allow public access to an S3 bucket, then it should look something like this:

{
    "Sid": "PublicReadGetObject",
    "Effect": "Allow",
    "Principal": "*",
    "Action": "s3:GetObject",
    "Resource": "arn:aws:s3:::bucketname/*"
}