What permission is needed to use S3 listObjectVersions in AWS?

Question

I currently have a lambda that uses the node sdk call listObjectVersions to list all the versions of a specific file. However, I can't figure out what permission in my policy will grant the lambda permission to make this call. I've searched the AWS documentation and I can not find any information.

Here are the current permissions in my policy:

- PolicyName: S3Policy
  PolicyDocument:
    Version: 2012-10-17
    Statement:
      - Effect: Allow
        Action:
          - s3:PutObject
          - s3:PutObjectAcl
          - s3:GetObject
          - s3:GetObjectVersion
          - s3:ListObjectVersions
          - s3:DeleteObject
          - s3:ListBucket

When I execute the lambda I get an Access Denied when making the call. I've changed my policy to allow the action s3:* and the lambda works. However, I do not want to grant full access to s3.

What Action do I need to add to allow?

Answer 1

From Actions, Resources, and Condition Keys for Amazon S3 - AWS Identity and Access Management:

ListBucketVersions: Use the versions subresource to list metadata about all of the versions of objects in a bucket.

I tested this as follows:

• Created an IAM User
• Assigned the policy below
• Ran the command: aws s3api list-object-versions --bucket my-bucket

It worked successfully.

The policy was:

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": "s3:ListBucketVersions",
            "Resource": "*"
        }
    ]
}

So, while the naming seems a bit strange (List Object Versions vs List Bucket Versions), it is the correct permission to use.