title: What's the specific permission to allow an AWS IAM group access to change an S3 object's metadata?
body: <p>I want to grant an AWS IAM group permission to upload, view, modify, and delete objects in a single bucket, through the Management Console. I've got most of it down, but I'm getting reports that users in that group are <strong>unable to modify object metadata</strong> - they're getting the "Sorry! You were denied access to do that!" dialog.</p>
  
  <p>Here's the policy I have:</p>
  
  <pre><code>{
      "Version": "2012-10-17",
      "Statement": [
          {
              "Sid": "Stmt1403204838000",
              "Effect": "Allow",
              "Action": [
                  "s3:ListBucket"
              ],
              "Resource": [
                  "arn:aws:s3:::example-bucket"
              ]
          },
          {
              "Sid": "Stmt1403205082000",
              "Effect": "Allow",
              "Action": [
                  "s3:GetBucketLocation",
                  "s3:ListAllMyBuckets"
              ],
              "Resource": [
                  "arn:aws:s3:::*"
              ]
          },
          {
              "Sid": "Stmt1403205119000",
              "Effect": "Allow",
              "Action": [
                  "s3:DeleteObject",
                  "s3:GetObject",
                  "s3:PutObject"
              ],
              "Resource": [
                  "arn:aws:s3:::example-bucket/*"
              ]
          }
      ]
  }
  </code></pre>
  
  <p>Does anyone know which S3 action(s) I need to assign to allow the group access to modify object properties (specifically, the metadata)?</p>