Correct S3 Policy For Pre-Signed URLs

Question

I need to issue pre-signed URLs for allowing users to GET and PUT files into a specific S3 bucket. I created an IAM user and use its keys to create the pre-signed URLs, and added a custom policy embedded in that user (see below). When I use the generated URL, I get an AccessDenied error with my policy. If I add the FullS3Access policy to the IAM user, the file can be GET or PUT with the same URL, so obviously, my custom policy is lacking. What is wrong with it?

Here's the custom policy I am using that is not working:

{     "Statement": [         {             "Action": [                 "s3:ListBucket"             ],             "Effect": "Allow",             "Resource": [                 "arn:aws:s3:::MyBucket"             ]         },         {             "Action": [                 "s3:AbortMultipartUpload",                 "s3:CreateBucket",                 "s3:DeleteBucket",                 "s3:DeleteBucketPolicy",                 "s3:DeleteObject",                 "s3:GetBucketPolicy",                 "s3:GetLifecycleConfiguration",                 "s3:GetObject",                 "s3:ListBucket",                 "s3:ListBucketMultipartUploads",                 "s3:ListMultipartUploadParts",                 "s3:PutBucketPolicy",                 "s3:PutLifecycleConfiguration",                 "s3:PutObject"             ],             "Effect": "Allow",             "Resource": [                 "arn:aws:s3:::MyBucket/*"             ]         }     ] } 

Answer 1

Here is an IAM policy that works for my presigned S3 URLs.

{     "Version": "2012-10-17",     "Statement": [       {         "Sid": "VisualEditor0",         "Effect": "Allow",         "Action": [             "s3:PutObject",             "s3:GetObject"         ],         "Resource": "arn:aws:s3:::mydocs/*"       }     ] } 

I wonder if your problem is in the Resource part. Were your GET requests for bucket MyBucket always?