title: What AWS IAM role policies do I need to write files to S3?
body: <p>I'm trying to configure a Kinesis Firehose delivery stream to write files to S3. I've created the Firehose stream to use a role named <code>att1</code>. </p>
  
  <p>This is the policy attached to <code>att</code>'s configuration. I took the format from this page here <a href="https://docs.aws.amazon.com/firehose/latest/dev/controlling-access.html#using-iam-s3" rel="nofollow">https://docs.aws.amazon.com/firehose/latest/dev/controlling-access.html#using-iam-s3</a></p>
  
  <p>I've validated the policy, but I'm not sure if it's correct.</p>
  
  <pre><code>{
      "Version": "2012-10-17",
      "Statement": [
          {
              "Sid": "",
              "Effect": "Allow",
              "Action": [
                  "s3:AbortMultipartUpload",
                  "s3:GetBucketLocation",
                  "s3:GetObject",
                  "s3:ListBucket",
                  "s3:ListBucketMultipartUploads",
                  "s3:*",
                  "s3:PutObject"
              ],
              "Resource": [
                  "arn:aws:s3:::s3bucket",
                  "arn:aws:s3:::s3bucket/*"
              ]
          },
          {
              "Effect": "Allow",
              "Action": [
                  "kms:Decrypt",
                  "kms:GenerateDataKey"
              ],
              "Resource": [
                  "arn:aws:kms:us-east-1:515766555555:key/cdee14ca-12b1-4790-9513-d007a3192f43"
              ],
              "Condition": {
                  "StringEquals": {
                      "kms:ViaService": "s3.us-east-1.amazonaws.com"
                  },
                  "StringLike": {
                      "kms:EncryptionContext:aws:s3:arn": "arn:aws:s3:::s3bucket*"
                  }
              }
          }
      ]
  }
  </code></pre>
  
  <p>Configuration has obviously been edited for privacy settings, but otherwise this is copied straight out of the policy</p>