AWS S3 policies confusions
Question: I would like to give read (download) right to a single user. I am confused
about what I should use:

Should I use

  * The Bucket Policy Editor from the S3 interface 
  * The inline policies for the user and specify read permissions (from IAM interface)
  * Activate "Any Authenticated AWS User" has the right to read (from s3 interface) and then use inline permissions for more granularity ?

I used the inline policies and it won't work:

    
    
    {
        "Version": "2012-10-17",
        "Statement": [
            {
                "Sid": "AllowUserToReadObject",
                "Action": [
                    "s3:GetObject",
                    "s3:GetObjectVersion",
                    "s3:GetObjectTorrent"
                ],
                "Effect": "Allow",
                "Resource": [
                    "arn:aws:s3:::staging/*",
                    "arn:aws:s3:::prod/*"
                ]
            }
        ]
    }
    

When I use Boto:

    
    
    #!/usr/bin/env python
    # -*- coding: utf-8 -*-
    from boto.s3.connection import S3Connection
    from boto.s3.key import Key
    import sys, os
    
    AWS_KEY = ''
    AWS_SECRET = ''
    
    
    
    from boto.s3.connection import S3Connection
    
    conn = S3Connection(AWS_KEY, AWS_SECRET)
    
    bucket = conn.get_bucket('staging')
    for key in bucket.list():
        print key.name.encode('utf-8')
    

I got the following error:

    
    
    Traceback (most recent call last):
      File "listing_bucket_files.py", line 20, in <module>
        bucket = conn.get_bucket('staging')
      File "/usr/local/lib/python2.7/dist-packages/boto/s3/connection.py", line 503, in get_bucket
        return self.head_bucket(bucket_name, headers=headers)
      File "/usr/local/lib/python2.7/dist-packages/boto/s3/connection.py", line 536, in head_bucket
        raise err
    boto.exception.S3ResponseError: S3ResponseError: 403 Forbidden
    


Answer: You didn't assign `"s3:ListBucket"` permission, that the account was stopped
at the access to buckets of `staging` and `prod`, then has no permission to
access the files/folders in these buckets.

Remember you have to seperate the code as below, and don't add `/*` after
bucket name.

    
    
       "Statement": [
            {
                "Effect": "Allow",
                "Action": [
                    "s3:ListBucket"
                ],
                "Resource": [
                    "arn:aws:s3:::staging",
                    "arn:aws:s3:::prod",
                ]
            },
    

