AWS S3: user policy for specifc bucket - amazon-web-services

Question

I just setup my AWS S3.
My application works with full-admin-acces-keys, but because this can be risky, I want to setup an IAM-user with an IAM-group and allow only S3-stuff for him.
My bucket is located in eu-central-1 and its name is 'MYBCKET' in the following policy:
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": [
"s3:ListBucket"
],
"Resource": [
"arn:aws:s3:::MYBCKET"
]
},
{
"Effect": "Allow",
"Action": [
"s3:PutObject",
"s3:GetObject",
"s3:DeleteObject"
],
"Resource": [
"arn:aws:s3:::MYBCKET/*"
]
}
]
}
This is NOT working. If I give the user the following policy it's working:
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": [
"s3:ListBucket"
],
"Resource": [
"*"
]
},
{
"Effect": "Allow",
"Action": [
"s3:PutObject",
"s3:GetObject",
"s3:DeleteObject"
],
"Resource": [
"*"
]
}
]
}
It has to be something with the resource for sure.
Can somebody explain to me what the resource consists of so that i can understand and hopefully find errors?
Just to tell you: I am sure I spelled my buckets name right and also I tried different combinations in the resource arn:aws:s3:::MYBCKET/* AND arn:aws:s3:::MYBCKET and some other that did not work.
Thanks for your answers and time.

Answer 1

I don't see anything wrong with your policy, if the intent is the user should access the bucket programatically.
If the user also needs to be able to access the policy thru the console, you could try this instead which will allow the user to list the buckets:
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": [
"s3:GetBucketLocation",
"s3:ListAllMyBuckets"
],
"Resource": "arn:aws:s3:::*"
},
{
"Effect": "Allow",
"Action": ["s3:ListBucket"],
"Resource": ["arn:aws:s3::: MYBCKET"]
},
{
"Effect": "Allow",
"Action": [
"s3:PutObject",
"s3:GetObject",
"s3:DeleteObject"
],
"Resource": ["arn:aws:s3::: MYBCKET/*"]
}
]
}