title: AWS Bucket Policy Error: Policy has invalid action
body: <p>I have a very basic goal: to share all content of my bucket to a list of specific users, read only. This used to work with a tool called s3cmd. All I need to do was to add a user (identified by email) to the <code>Access Control List with Read Permission</code>, and they could list or download data smoothly.</p>
  <p>But recently, this suddenly did not work anymore. The system just denies any attempt to access my bucket.</p>
  <p>I then started thinking of editing the bucket policy. Here is the draft of my policy, generated by the Policy Generator (sensitive information is anonymized):</p>
  <pre class="lang-json prettyprint-override"><code>    {
        &quot;Id&quot;: &quot;Policy123456789&quot;,
        &quot;Version&quot;: &quot;2012-10-17&quot;,
        &quot;Statement&quot;: [
          {
            &quot;Sid&quot;: &quot;Stmt1512705836469&quot;,
            &quot;Action&quot;: [
              &quot;s3:GetObject&quot;,
              &quot;s3:ListBucket&quot;,
              &quot;s3:ListObjects&quot;
            ],
            &quot;Effect&quot;: &quot;Allow&quot;,
            &quot;Resource&quot;: &quot;arn:aws:s3:::mybucketname&quot;,
            &quot;Principal&quot;: {
              &quot;AWS&quot;: [
                &quot;arn:aws:iam::anotheruserid:user/admin&quot;
              ]
            }
          }
        ]
      }
  </code></pre>
  <p>When I click <code>save</code>, I get a &quot;<strong>Policy has invalid action</strong>&quot; error. I then tried to remove &quot;<em>ListObjects</em>&quot; so the policy becomes</p>
  <pre class="lang-json prettyprint-override"><code>    {
        &quot;Id&quot;: &quot;Policy123456789&quot;,
        &quot;Version&quot;: &quot;2012-10-17&quot;,
        &quot;Statement&quot;: [
          {
            &quot;Sid&quot;: &quot;Stmt1512705836469&quot;,
            &quot;Action&quot;: [
              &quot;s3:GetObject&quot;,
              &quot;s3:ListBucket&quot;
            ],
            &quot;Effect&quot;: &quot;Allow&quot;,
            &quot;Resource&quot;: &quot;arn:aws:s3:::mybucketname&quot;,
            &quot;Principal&quot;: {
              &quot;AWS&quot;: [
                &quot;arn:aws:iam::anotheruserid:user/admin&quot;
              ]
            }
          }
        ]
      }
  </code></pre>
  <p>and got another error message &quot;<strong>Action does not apply to any resource(s) in statement</strong>&quot;.</p>
  <p>These two errors do not make sense to me. Please correct me if I am wrong. If I am not in the right direction, please help me.</p>
  <p>BTW: I tried to follow the tutorial at
  <a href="http://docs.aws.amazon.com/AmazonS3/latest/dev/example-walkthroughs-managing-access-example2.html" rel="nofollow noreferrer">http://docs.aws.amazon.com/AmazonS3/latest/dev/example-walkthroughs-managing-access-example2.html</a>
  but wasn't successful. By using the following bucket policy:</p>
  <pre class="lang-Json prettyprint-override"><code>    {
         &quot;Version&quot;: &quot;2012-10-17&quot;,
         &quot;Statement&quot;: [
            {
               &quot;Sid&quot;: &quot;Example permissions&quot;,
               &quot;Effect&quot;: &quot;Allow&quot;,
               &quot;Principal&quot;: {
                  &quot;AWS&quot;: &quot;arn:aws:iam::AccountB-ID:root&quot;
               },
               &quot;Action&quot;: [
                  &quot;s3:GetBucketLocation&quot;,
                  &quot;s3:ListBucket&quot;
               ],
               &quot;Resource&quot;: [
                  &quot;arn:aws:s3:::examplebucket&quot;
               ]
            }
         ]
      }
  </code></pre>
  <p>I got an error message when using awscli of AccountB to execute &quot;<strong>aws s3 ls s3://examplebucket</strong>&quot;.<br />
  The error message was &quot;<strong>An error occurred (AccessDenied) when calling the ListObjects operation: Access Denied</strong>&quot;.</p>
  <p>This confuses me. If I add <em>ListObjects</em>, I got an <code>&quot;invalid&quot; error</code>.<br />
  If I remove the &quot;<strong>ListObjects</strong>&quot;, another user could not read my bucket content.</p>
  <p>What should I do?</p>