I am trying to set up the proper policy json for IAM programmatic access, but the following runs into the below error ... I have tried it also without sid and with Resource as an array.
"Version": "2012-10-17",
"Statement":
{
"Effect": "Allow",
"Sid": "AllowAllPollyActions",
"Action": [
"polly:*"
],
"Resource": "*"
}}
is not authorized to perform: polly:SynthesizeSpeech with an explicit deny in an identity-based policy
Related
I am using Security Token Service to generate credentials access_key_id and secret_access_key to pass it to the client side. I am able to generate credentials successfully. But, when I use dynamically generated credentials I got this error
AWS::S3::Errors::InvalidAccessKeyId The AWS Access Key Id you provided does not exist in our records
Followings are the steps I have used to generate credentials with Security Token Service
Create Role
I have created a role on AWS with following policy (to list and upload files on AWS S3 bucket)
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": "s3:ListBucket",
"Resource": "arn:aws:s3:::<bucket_name>"
},
{
"Effect": "Allow",
"Action": [
"s3:GetObject",
"s3:PutObject"
],
"Resource": "arn:aws:s3:::<bucket_name>/*"
}
]
}
Edit Trust Relationship
I have edited trust relationship to assign role to the IAM user
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Principal": {
"AWS": "arn:aws:iam::<account_id>:user/<user_name>"
},
"Action": "sts:AssumeRole",
"Condition": {}
}
]
}
How I am generating credentials
sts = Aws::STS::Client.new
session = sts.assume_role(role_arn: 'arn:aws:iam::<account_id>:role/<role_name>', role_session_name: 'test_session')
#aws_access_key_id = session.credentials.access_key_id
#aws_secret_access_key = session.credentials.secret_access_key
#aws_security_token = session.credentials.session_token
#expires_at = session.credentials.expiration
I am able to generated credentials but credentials are invalid.
Thanks
I am trying to restrict direct access to files in aws s3 bucket, only from website that file should be visible, I tried with different policies. But nothing is working for me.
{
"Version": "2012-10-17",
"Id": "http referer policy example",
"Statement": [
{
"Sid": "Allow get requests referred by www.example.com and example.com.",
"Effect": "Allow",
"Principal": "*",
"Action": "s3:GetObject",
"Resource": "arn:aws:s3:::ex-bucket/*",
"Condition": {
"StringLike": {"aws:Referer": ["https://www.example.com/*","https://example.com/*"]}
}
},
{
"Sid": "IPAllow",
"Effect": "Allow",
"Principal": "*",
"Action": "s3:*",
"Resource": "arn:aws:s3:::ex-bucket/*",
"Condition": {
"NotIpAddress": {
"aws:SourceIp": "00.00.000.00"
},
"IpAddress": {
"aws:SourceIp": "00.00.000.00"
}
}
}
]
}
Any suggestions on this.
If you want to allow access to bucket with specific Domain try this
Below is an example of how to set www.example.com and example.com as valid refers.
Add the following policy in your “Add bucket policy” field:
{
"Version": "2012-10-17",
"Id": "http referer policy example",
"Statement": [
{
"Sid": "Allow get requests originating from www.example.com and example.com.",
"Effect": "Allow",
"Principal": "*",
"Action": "s3:GetObject",
"Resource": "arn:aws:s3:::s3-foo-bar/*",
"Condition": {
"StringLike": {
"aws:Referer": [
"http://www.example.com/*",
"http://example.com/*"
]
}
}
}
By default accounts are restricted from accessing S3 unless they have been given access via policy. However, S3 is designed by default to allow any IP address access. So to block IP's you would have to specify denies explicitly in the policy instead of allows.
{
"Id": "S3PolicyId1",
"Statement": [
{
"Sid": "IPDeny",
"Effect": "Deny",
"Principal": {
"AWS": "*"
},
"Action": "s3:*",
"Resource": "arn:aws:s3:::s3-foo-bar/*",
"Condition": {
"NotIpAddress": {
"aws:SourceIp": "Your IP Address CIDR Notation"
}
}
}
]
}
If you want to disable direct access to bucket:
You can make the files private and generate signed URLs to allow someone temporary access to the files: Share an Object with Others
Another Method can be you can Serve Private Content via Cloudfront
Or you can set a policy to restrict people from accessing the files directly which is mentioned above, only allowing them to access a file if it was linked from your website
Or you can serve those files by sending them through some script, i.e. download the file to your server and returning the file contents from there. In which case you can just make those files private in S3 or even move them to a separate bucket that is completely private. I would not recommend this method because it puts more load on your server.
Hope This helps
I'm getting acquainted with using S3 with ruby to upload files to Amazon Web Service. I recently was confronted with the following error: AWS::S3::Errors::AccessDenied Access Denied. In poking around on google, I found this post on the error. It claims that the bucket policies aren't sufficient to allow access via the web-app and that the user must be given "Administrator Access" as well.
I've given this a try and it works fine but I feel like this is an indication that I'm not doing it right, given that administrator access isn't mentioned in any other documentation I've read. I'm using the aws-sdk gem. Could anyone weigh in on whether admin access is necessary? Many thanks!
None of the existing answers actually state which policies you need to grant, so here they are: s3:PutObject, s3:DeleteObject, and s3:PutObjectAcl.
Here's the complete S3 bucket policy I'm using to allow Paperclip to put objects with the :public_read permission:
{
"Version": "2008-10-17",
"Statement": [
{
"Effect": "Allow",
"Principal": {
"AWS": "arn:aws:iam::IAM_USER_ID:user/IAM_USER_NAME"
},
"Action": [
"s3:PutObject",
"s3:DeleteObject",
"s3:PutObjectAcl"
],
"Resource": "arn:aws:s3:::S3_BUCKET_NAME/*"
}
]
}
As explained in the accepted answer, you should not need "Admin Access". However, the typical policy for giving access to a bucket, as documented in some examples given by Amazon, could not be enough for paperclip.
The following policy worked for me:
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": [
"s3:GetBucketLocation",
"s3:ListAllMyBuckets"
],
"Resource": "arn:aws:s3:::*"
},
{
"Effect": "Allow",
"Action": [
"s3:ListBucket"
],
"Resource": [
"arn:aws:s3:::bucket-name-to-be-set-by-you"
]
},
{
"Effect": "Allow",
"Action": "s3:*",
"Resource": [
"arn:aws:s3:::bucket-name-to-be-set-by-you/*"
]
}
]
}
You should not really need the Admin Access to achieve this.
Make sure you have AWS access_key_id and secret_access_key setup in your heroku config. And, you also would need to make sure your user account has an Access Policy set in the AWS IAM Console.
See this post for some more info.
The default permission for Paperclip is :public_read unless you specify the bucket to be private.
See this for information about Module: Paperclip::Storage::S3
I have created an IAM policy to allow Cognito users to write to my S3 bucket, but I would like to restrict them to folders based on their Cognito ID. I've followed Amazon's instructions here and created a policy that looks like this:
{
"Effect": "Allow",
"Action": ["s3:PutObject","s3:GetObject"],
"Resource": [
"arn:aws:s3:::mybucket/myappfolder/${cognito-identity.amazonaws.com:sub}*"
]
}
But when I try to upload using the v2 of the AWS iOS SDK I get an access denied error.
If I modify the last path component of the resource to replace ${cognito-identity.amazonaws.com:sub} with the explicit identityId value I am getting from the SDK's AWSCognitoCredentialsProvider it works.
{
"Effect": "Allow",
"Action": ["s3:PutObject","s3:GetObject"],
"Resource": [
"arn:aws:s3:::mybucket/myappfolder/us-east-1:xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx*"
]
}
My understanding was that these should equate to the same thing. Am I missing something in my policy, or should I be using a different path in my upload request?
** Update **
I originally had this problem in iOS, so tonight I tried doing the same thing in node.js and the result is identical. Here is the simple code I am using in node:
var s3 = new AWS.S3();
AWS.config.region = 'us-east-1';
AWS.config.credentials = new AWS.CognitoIdentityCredentials(AWSParams);
AWS.config.credentials.get(function (err) {
if (!err) {
console.log("Cognito Identity Id: " + AWS.config.credentials.identityId);
var bucketName = 'ch123_test_bucket';
var keyName = AWS.config.credentials.identityId + '.txt';
var params = {Bucket: bucketName, Key: keyName, Body: 'Hello World!'};
s3.putObject(params, function (err, data) {
if (err)
console.log(err)
else
console.log("Successfully uploaded data to " + bucketName + "/" + keyName);
});
}
And I get the same results that I get with iOS: unless I supply an explicit cognito ID in the IAM policy the API responds with 403.
I've stripped my IAM policy down to the very bare minimum. This doesn't work:
{
"Statement": [
{
"Effect": "Allow",
"Action": ["s3:PutObject","s3:GetObject"],
"Resource": [
"arn:aws:s3:::ch123_test_bucket/${cognito-identity.amazonaws.com:sub}*"
]
}
]
}
This does:
{
"Statement": [
{
"Effect": "Allow",
"Action": ["s3:PutObject","s3:GetObject"],
"Resource": [
"arn:aws:s3:::ch123_test_bucket/us-east-1:68a5dc49-6cc7-4289-8257-d3d5636f7034*"
]
}
]
}
I don't see what I'm missing here...the only documentation I've been able to find always shows the same example Resource value that I've been using.
Unfortunately there is currently an issue with the roles generated via the Cognito console in combination with policy variables. Please update your roles' access policy to include the following to ensure policy variables are evaluated correctly:
"Version": "2012-10-17"
2014-09-16 Update: We have updated the Amazon Cognito console to correct this issue for new roles created via the Identity Pool creation wizard. Existing roles will still need to make the modification noted above.
You are missing last slash.
{
"Effect": "Allow",
"Action": ["s3:PutObject","s3:GetObject"],
"Resource": [
"arn:aws:s3:::mybucket/cognito/myappfolder/${cognito-identity.amazonaws.com:sub}/*"
]
}
Also try to consider this article.
UPDATE: It works when I remove the explicit deny block from the bucket policy, but I need that in there to prevent people outside the site (including bots) from accessing the content.
--
I'm trying to figure out a way to set access control on my S3 content such that:
Users with HTTP referrer mydomain.com can view the files
Paperclip gem can upload files
Google bots can't crawl and index the files
Viewing existing files from the site works fine, but uploading a file gives this error in the console:
[AWS S3 403 0.094338 0 retries] put_object(:acl=>:public_read,
:bucket_name=>"mybucket",:content_length=>879394,
:content_type=>"image/jpeg",:data=>Paperclip::FileAdapter: Chrysanthemum.jpg,
:key=>"ckeditor_assets/pictures/6/original_chrysanthemum.jpg",
:referer=>"mydomain.com/")
AWS::S3::Errors::AccessDenied Access Denied
Here's the bucket policy I have:
{
"Version": "2012-10-17",
"Id": "http referer policy example",
"Statement": [
{
"Sid": "Allow get requests referred by mydomain.com",
"Effect": "Allow",
"Principal": "*",
"Action": [
"s3:GetObjectVersion",
"s3:DeleteObject",
"s3:DeleteObjectVersion",
"s3:GetObject",
"s3:PutObject"
],
"Resource": "arn:aws:s3:::mybucket/*",
"Condition": {
"StringLike": {
"aws:Referer": "mydomain.com/*"
}
}
},
{
"Sid": "Explicit deny to ensure requests are allowed only from specific referer.",
"Effect": "Deny",
"Principal": "*",
"Action": "s3:*",
"Resource": "arn:aws:s3:::mybucket/*",
"Condition": {
"StringNotLike": {
"aws:Referer": "mydomain.com/*"
}
}
}
]
}
The error message is odd, because I explicitly set the referrer to mydomain.com in Paperclip settings:
production.rb:
:s3_headers => {
'Referer' => 'mydomain.com'
}
And Paperclip does indeed use it, as shown on the second to last line of the error message.
So why does it still give Access Denied?
After fiddling with it for hours, I revised my approach in light of the original three requirements I listed. I'm now explicitly denying only GetObject (as opposed to everything via "*"), and I also placed a robots.txt file at the root of my bucket and made it public. Therefore:
Users can access bucket content only when my site is the referer (maybe this header can be spoofed, but I'm not too worried at this point). I tested this by copying a resource's link and emailing it to myself, and opening it from within the email. I got access denied, which confirmed that it cannot be hotlinked on other sites.
Paperclip can upload and delete files
Google can't index the bucket contents (hopefully robots.txt will be sufficient)
My final bucket policy for those who arrive at this via Google in the future:
{
"Version": "2012-10-17",
"Id": "http referer policy example",
"Statement": [
{
"Sid": "Allow get requests referred by mydomain.com",
"Effect": "Allow",
"Principal": "*",
"Action": "s3:*",
"Resource": "arn:aws:s3:::mybucket/*",
"Condition": {
"StringLike": {
"aws:Referer": "https://mydomain.com/*"
}
}
},
{
"Sid": "Explicit deny to ensure requests are allowed only from specific referer.",
"Effect": "Deny",
"Principal": "*",
"Action": "s3:GetObject*",
"Resource": "arn:aws:s3:::mybucket/*",
"Condition": {
"StringNotLike": {
"aws:Referer": "https://mydomain.com/*"
}
}
}
]
}
I do have a theory on why it didn't work. I was reading the S3 documentation on Specifying Conditions in a Policy, and I noticed this warning:
Important:
Not all conditions make sense for all actions. For example, it makes sense to include an s3:LocationConstraint condition on a policy that grants the s3:PutBucket Amazon S3 permission, but not for the s3:GetObject permission. S3 can test for semantic errors of this type that involve Amazon S3–specific conditions. However, if you are creating a policy for an IAM user and you include a semantically invalid S3 condition, no error is reported, because IAM cannot validate S3 conditions.
So maybe the Referer condition did not make sense for the PutObject action. I figured I'd include this in case someone decides to pick this issue up from here and pursue it to the end. :)