title: Policy Denying Access On Amazon S3
body: <p>Using s3cmd the policy below allows me to ListAllBuckets like this :</p>
  
  <pre><code>s3cmd ls
  </code></pre>
  
  <p>and ListBucket like this :</p>
  
  <pre><code>s3cmd ls s3://backups/
  </code></pre>
  
  <p>but I cannot upload a file like this :</p>
  
  <pre><code>s3cmd put filename s3://backups/
  </code></pre>
  
  <p>I just get this error :</p>
  
  <pre><code>ERROR: S3 error: Access Denied
  </code></pre>
  
  <p>The policy is based on searching and many examples on the web, but I just cannot see where it's going wrong. The policy is to allow a user to just upload files to a backup directory (ultimately I don't even what them to list the buckets but I put that in just to check the policy was in fact being read at all).</p>
  
  <p>Other possibly relevant info -</p>
  
  <ul>
  <li>I created the bucket using Dragon Disk (a front end for S3) with a different user</li>
  <li>This new IAM user is connected to the policy by belonging to a group that has the policy attached.</li>
  </ul>
  
  <p>Here's the policy, note that the CreateObject and PutObject were the only two original entries, the others were added almost just to see what happened :</p>
  
  <pre><code>{
      "Version": "2012-10-17",
      "Statement": [
          {
              "Effect": "Allow",
              "Action": [
                  "s3:ListAllMyBuckets",
                  "s3:ListBucket"
              ],
              "Resource": "arn:aws:s3:::*"
          },
          {
              "Effect": "Allow",
              "Action": [
                  "s3:PutObject",
                  "s3:PutObjectAcl",
                  "s3:PutObjectVersionAcl",
                  "s3:CreateObject",
                  "s3:*"
              ],
              "Resource": "arn:aws:s3:::backups/*"
          }
      ]
  }
  </code></pre>
  
  <p>EDIT 1 -</p>
  
  <p>Just to say that if I add this policy it works fine, so I know it's something to do with my policy :</p>
  
  <pre><code>{
    "Version": "2012-10-17",
    "Statement": [
      {
        "Effect": "Allow",
        "Action": "s3:*",
        "Resource": "*"
      }
    ]
  }
  </code></pre>
  
  <p>EDIT 2 -
  I have made another policy which I have used to create a bucket called "asdwasw432", just in case for whatever reason my UI created bucket was unusable. But I still cannot upload any file to it (Access Denied). I can list the bucket and create new buckets. All the advice seems to tell me to do exactly what I am doing below, but none if it works. Am I missing something else?</p>
  
  <pre><code>{
      "Version": "2012-10-17",
      "Statement": [
          {
              "Sid": "Stmt1397834652000",
              "Effect": "Allow",
              "Action": [
                  "s3:ListAllMyBuckets"
              ],
              "Resource": [
                  "arn:aws:s3:::*"
              ]
          },
          {
              "Sid": "Stmt1397834745000",
              "Effect": "Allow",
              "Action": [
                  "s3:ListBucket",
                  "s3:PutObject",
                  "s3:PutObjectAcl"
              ],
              "Resource": [
                  "arn:aws:s3:::asdwasw432",
                  "arn:aws:s3:::asdwasw432/*"
              ]
          }
      ]
  }
  </code></pre>