How to fix "Access denied" on opening image url - amazon-web-services

Question

I finally managed to upload some images to my s3 bucket but I can't open them. If I navigate to them in my bucket i get "object URL" but every time I try to open it I get:
<Error>
<Code>AccessDenied</Code>
<Message>Access Denied</Message>
<RequestId>7F4BB573F589D927</RequestId>
<HostId>GkYjQGNkrh84HodCaQxfTHKFCDLle82B5d4oa6EyeK1ZJMt/BeZG09eS2CIiR6Ri2Va/IvQIcIE=</HostId>
</Error>
I added bucket policy:
{
"Version": "2012-10-17",
"Id": "Policy1547051060680",
"Statement": [
{
"Sid": "Stmt1547051055882",
"Effect": "Allow",
"Principal": "*",
"Action": "s3:*",
"Resource": "arn:aws:s3:::bucket-name06/*"
}
]
}
but it doesn't seem to work. Is there anything else I can do?

Answer 1

You bucket policy is already public so you don't need to modify anything in the policy. You need to set ACL property to 'public-read' when using PutObject API. Also, don't leave bucket policy public assign it a policy to restrict upload.

Answer 2

You will need to give your IAM role, that you are using to access the account, read permissions to the bucket. You can do an attach policy or in json it can look something like this
{
"Sid": "S3Read",
"Effect": "Allow",
"Action": [
"s3:Get*",
"s3:List*"
],
"Resource": [
"arn:aws:s3:::bucket-name06",
"arn:aws:s3:::bucket-name06/*"
]
}
Assuming the s3 bucket is on the same account as the IAM role you are trying to access you do not need to enable cross account access. If they are not, you will need to allow on the bucket side for the IAM role to read the bucket.
If you need write access you can do something similar to this
{
"Sid": "S3Write",
"Effect": "Allow",
"Action": [
"s3:AbortMultipartUpload",
"s3:DeleteObject",
"s3:Get*",
"s3:List*",
"s3:Put*",
],
"Resource": [
"arn:aws:s3:::bucket-name06",
"arn:aws:s3:::bucket-name06/*"
]
}