title: How to give permission to a federated user in boto to an s3 bucket?
body: <p>Tried figuring out from the documentation but can not create a federated user who can access the s3 bucket</p>
  
  <p>First the imports</p>
  
  <pre><code>&gt;&gt;&gt; from boto.s3.connection import S3Connection
  &gt;&gt;&gt; from boto.sts import STSConnection
  </code></pre>
  
  <p>Then create a bucket in s3</p>
  
  <pre><code>&gt;&gt;&gt; s3c = ('access key', 'secret key')  
  &gt;&gt;&gt; s3c.create_bucket('ranjith_new_bucket')
  </code></pre>
  
  <p>Then create a federated user, which if I correctly understand, is a way of creating temporary credentials</p>
  
  <pre><code>&gt;&gt;&gt; sts = STSConnection('access key', 'secret key')  
  &gt;&gt;&gt; user = sts.get_federation_token('guest_user_1')
  </code></pre>
  
  <p>But when I try to get the list of all accessible buckets, I get an error.</p>
  
  <pre><code>&gt;&gt;&gt; s3c2 = S3Connection(user.credentials.access_key, user.credentials.secret_key)
  &gt;&gt;&gt; s3c2.get_all_buckets()
  
  Traceback (most recent call last):
    File "&lt;stdin&gt;", line 1, in &lt;module&gt;
    File "/home/ranjith/work/venv/local/lib/python2.7/site-packages/boto-2.16.0-py2.7.egg/boto/s3/connection.py", line 387, in get_all_buckets
      response.status, response.reason, body)
  boto.exception.S3ResponseError: S3ResponseError: 403 Forbidden
  &lt;?xml version="1.0" encoding="UTF-8"?&gt;
  &lt;Error&gt;&lt;Code&gt;InvalidAccessKeyId&lt;/Code&gt;&lt;Message&gt;The AWS Access Key Id you provided does not exist in our records.&lt;/Message&gt;&lt;RequestId&gt;154CDA2184E00650&lt;/RequestId&gt;&lt;HostId&gt;xxx&lt;/HostId&gt;&lt;AWSAccessKeyId&gt;xxx&lt;/AWSAccessKeyId&gt;&lt;/Error&gt;
  </code></pre>
  
  <p><a href="http://docs.pythonboto.org/en/latest/ref/sts.html#boto.sts.STSConnection.get_federation_token" rel="nofollow">The documentation</a> says that I have to provide an policy string, but the documentation is very tough to digest. I know I have to define a policy somewhere and use it while creating federated user but not sure where or how to do just that.</p>
  
  <p>I did try this: </p>
  
  <pre><code>permission = {
    "Version": "2012-10-17",
    "Statement": [
      {
         "Effect": "Allow",
         "Action": ["sts:GetFederationToken"],
         "Resource": "*"
       },
      {
         "Effect": "Allow",
         "Action": ["s3:*"],
         "Resource": "arn:aws:s3:::mybucket/ranjith_new_bucket/*"
       }
     ]
   }
  
  sts.get_federation_token('some_other_user', json.dumps(permission))
  
  Traceback (most recent call last):
    File "&lt;stdin&gt;", line 1, in &lt;module&gt;
    File "/home/ranjith/work/venv/local/lib/python2.7/site-packages/boto-2.16.0-py2.7.egg/boto/sts/connection.py", line 235, in get_federation_token
      FederationToken, verb='POST')
    File "/home/ranjith/work/venv/local/lib/python2.7/site-packages/boto-2.16.0-py2.7.egg/boto/connection.py", line 1138, in get_object
      raise self.ResponseError(response.status, response.reason, body)
  boto.exception.BotoServerError: BotoServerError: 400 Bad Request
  &lt;ErrorResponse xmlns="https://sts.amazonaws.com/doc/2011-06-15/"&gt;
    &lt;Error&gt;
      &lt;Type&gt;Sender&lt;/Type&gt;
      &lt;Code&gt;MalformedInput&lt;/Code&gt;
    &lt;/Error&gt;
    &lt;RequestId&gt;75734932-4ac1-11e3-a17b-e9e245983c07&lt;/RequestId&gt;
  &lt;/ErrorResponse&gt;
  </code></pre>
  
  <p>which is really silly because all I did is to put in json dump of the policy. I am not even able to find any online resources for the problem.</p>
  
  <p>It would be great if some one could guide me so that I end up creating a federated user with access to <code>ranjith_new_bucket</code> created above. Code snippets will be appreciated.</p>