title: Getting `AccessDenied` when calling any operation in AWS bucket policy
body: <p>I have a private s3 Bucket that I've selected to <code>Block *all* public access</code> on in settings.
  when I try to collect static I get an access denied error:</p>
  <pre><code>botocore.exceptions.ClientError: An error occurred (AccessDenied) when calling the PutObject operation: Access Denied
  </code></pre>
  <p>Also, when trying to access the static files (i.e. js &amp; css) that I've manually uploaded I get <code>403</code> code</p>
  <p>I've made a bucket policy based on <a href="https://stackoverflow.com/a/45733919/13487763">this post</a>:</p>
  <pre class="lang-json prettyprint-override"><code>{
      &quot;Version&quot;: &quot;2012-10-17&quot;,
      &quot;Id&quot;: &quot;Policy16144340382381&quot;,
      &quot;Statement&quot;: [
          {
              &quot;Sid&quot;: &quot;Stmt16144340315031&quot;,
              &quot;Effect&quot;: &quot;Allow&quot;,
              &quot;Principal&quot;: {
                  &quot;AWS&quot;: &quot;arn:aws:iam::634515378440:user/myapp-user&quot;
              },
              &quot;Action&quot;: [
                  &quot;s3:PutObject&quot;,
                  &quot;s3:AbortMultipartUpload&quot;,
                  &quot;s3:DeleteObject&quot;,
                  &quot;s3:GetObject&quot;,
                  &quot;s3:ListBucketMultipartUploads&quot;,
                  &quot;s3:ListMultipartUploadParts&quot;
              ],
              &quot;Resource&quot;: [
                  &quot;arn:aws:s3:::myapp-bucket&quot;,
                  &quot;arn:aws:s3:::myapp-bucket/*&quot;
              ]
          },
          {
              &quot;Sid&quot;: &quot;Stmt1614408230409&quot;,
              &quot;Effect&quot;: &quot;Allow&quot;,
              &quot;Principal&quot;: {
                  &quot;AWS&quot;: &quot;arn:aws:iam::634515378440:user/myapp-user&quot;
              },
              &quot;Action&quot;: &quot;*&quot;,
              &quot;Resource&quot;: &quot;arn:aws:s3:::myapp-bucket/*&quot;
          }
      ]
  }
  </code></pre>
  <p>I added the IAM user to a group with this permission policy:</p>
  <pre class="lang-json prettyprint-override"><code>{
      &quot;Version&quot;: &quot;2012-10-17&quot;,
      &quot;Statement&quot;: [
          {
              &quot;Sid&quot;: &quot;VisualEditor0&quot;,
              &quot;Effect&quot;: &quot;Allow&quot;,
              &quot;Action&quot;: [
                  &quot;s3:PutObject&quot;,
                  &quot;s3:GetObjectAcl&quot;,
                  &quot;s3:GetObject&quot;,
                  &quot;s3:ListBucketMultipartUploads&quot;,
                  &quot;s3:AbortMultipartUpload&quot;,
                  &quot;s3:PutObjectVersionAcl&quot;,
                  &quot;s3:ListBucket&quot;,
                  &quot;s3:DeleteObject&quot;,
                  &quot;s3:GetBucketLocation&quot;,
                  &quot;s3:PutObjectAcl&quot;,
                  &quot;s3:ListMultipartUploadParts&quot;
              ],
              &quot;Resource&quot;: [
                  &quot;arn:aws:s3:::myapp-bucket/*&quot;,
                  &quot;arn:aws:s3:::myapp-bucket&quot;
              ]
          },
          {
              &quot;Sid&quot;: &quot;VisualEditor1&quot;,
              &quot;Effect&quot;: &quot;Allow&quot;,
              &quot;Action&quot;: &quot;s3:ListAllMyBuckets&quot;,
              &quot;Resource&quot;: &quot;*&quot;
          }
      ]
  }
  </code></pre>
  <p>Also, here is the code in <code>settings.py</code> code that I've used to configure the app</p>
  <pre class="lang-py prettyprint-override"><code>INSTALLED_APPS = [
      ...
      'storages',
      ...
  ]
  # S3 BUCKETS CONFIG
  AWS_ACCESS_KEY_ID = os.environ['AWS_ACCESS_KEY_ID']
  AWS_SECRET_ACCESS_KEY = os.environ['AWS_SECRET_ACCESS_KEY']
  AWS_STORAGE_BUCKET_NAME = os.environ['AWS_STORAGE_BUCKET_NAME']
  AWS_S3_CUSTOM_DOMAIN = f'{AWS_STORAGE_BUCKET_NAME}.s3.amazonaws.com'
  AWS_S3_OBJECT_PARAMETERS = {'CacheControl': 'max-age=86400'}
  AWS_LOCATION = 'static'
  AWS_DEFAULT_ACL = 'public-read'
  AWS_S3_FILE_OVERWRITE = True
  STATICFILES_STORAGE = 'storages.backends.s3boto3.S3Boto3Storage'
  DEFAULT_FILE_STORAGE = 'myapp.storages.MediaStorage'
  </code></pre>
  <p>Here is <code>storages.py</code></p>
  <pre class="lang-py prettyprint-override"><code>from storages.backends.s3boto3 import S3Boto3Storage
  import os
  
  class MediaStorage(S3Boto3Storage):
      location = 'media'
      file_overwrite = True
      bucket_name = os.environ['AWS_STORAGE_BUCKET_NAME']
  </code></pre>
  <p>I've even tried making new users and buckets and adding them to the policy in case the credentials were wrong, but still no result. Is there a way I can verify that the connection is being made successfully and perhaps list the permissions the user has through the boto3 client?</p>
  <p>UPDATE:</p>
  <p>I configured my AWS CLI profile using <code>myapp-user</code>'s credentials, and it lets me list the buckets <code>aws s3 ls --profile myapp-user</code>, I was also able to run the <code>aws s3 cp</code> command to copy files between my local pc and the bucket just fine.
  So I know the credentials are fine; but at this point, I don't know what else I could do. I have made sure that the credentials I used in the AWS CLI config were identical to the ones in my env variables, but I still get the <code>AccessDenied</code> error.</p>