How can I set a policy for an s3 bucket that allows authenticated users to list the bucket or get any file from the bucket

Question

I have set a permission on the bucket that allows "Authenticated Users" to list, upload, and delete from a bucket I created. This seems to allow me to upload files to the bucket, but it appears that downloading files from the bucket is not covered by this permission, and I instead need to define a policy for the bucket. It's not clear to me how to set such a policy. I tried the policy generator with my best guesses at what I should fill in, but the result was not a valid policy when I pasted it in as a new policy for the bucket (it failed with the message Action does not apply to any resource(s) in statement - Action "s3:ListBucket" in Statement "Stmt-some-number"). Can someone explain what is wrong with the following policy and how to set it correctly to allow authenticated users to retrieve files from the bucket?

{   "Id": "Policy-some-number",   "Statement": [     {       "Sid": "Stmt-some-number",       "Action": [         "s3:GetObject",         "s3:ListBucket"       ],       "Effect": "Allow",       "Resource": "arn:aws:s3:::my-bucket/*",       "Principal": {         "AWS": [           "*"         ]       }     }   ] } 

Answer 1

s3:GetObject applies to the objects in the bucket so the Resource is correct: "Resource": "arn:aws:s3:::my-bucket/*".

s3:ListBucket applies to the Bucket itself and so the Resource should be "Resource": "arn:aws:s3:::my-bucket"

your resulting policy should resemble:

{   "Id": "Policy-some-number",   "Statement": [     {       "Sid": "Stmt-some-number",       "Action": [         "s3:GetObject"       ],       "Effect": "Allow",       "Resource": "arn:aws:s3:::my-bucket/*",       "Principal": {         "AWS": [           "*"         ]       }     },     {       "Sid": "Stmt-some-other-number",       "Action": [         "s3:ListBucket"       ],       "Effect": "Allow",       "Resource": "arn:aws:s3:::my-bucket",       "Principal": {         "AWS": [           "*"         ]       }     }   ] }