title: AWS IAM GroupPolicy - Why is the s3:PutObject permission not working?
body: <p>I have a group and I have applied the policy below to the group. I added a user to the group and created access keys for the user. I am able to Get from "mybucket" but I am not able to Put to "mybucket". When I try to Put, I get "Access Denied". Can anyone tell me what I am doing wrong. Please let me know.</p>
  
  <pre><code>   {
         "Statement":[{
            "Effect":"Allow",
            "Action":["s3:PutObject","s3:GetObject"],
            "Resource":["arn:aws:s3:::mybucket","arn:aws:s3:::mybucket/*"] 
            },
            {
            "Effect":"Deny",
            "Action":["*"],
            "NotResource":["arn:aws:s3:::mybucket","arn:aws:s3:::mybucket/*"]  
            }
         ]
      }
  </code></pre>
  
  <p>EDIT:  Someone asked me to state the goal of the policy.  I want to "Allow" only PUT and GET permissions to the group for the specified buckets.  I want to explicitly "Deny" all other permissions to the group for all resources NOT (NotResource) specified.  I added the explicit "Deny" based an article AWS posted that suggested that it was a good practice to do so.</p>