What permissions do django storage require for I3 s3 user?

Question

How the question is asked, what are the minimum required permissions for a blocked s3 IAM user to successfully use django repositories? Currently, I used something like

{ "Statement": [ { "Effect": "Allow", "Action": ["s3:ListAllMyBuckets"], "Resource": "arn:aws:s3:::*" }, { "Effect": "Allow", "Action": ["s3:ListBucket", "s3:GetBucketLocation", "s3:ListBucketMultipartUploads", "s3:ListBucketVersions"], "Resource": "arn:aws:s3:::bucket-name" }, { "Effect": "Allow", "Action": ["s3:*Object*", "s3:ListMultipartUploadParts", "s3:AbortMultipartUpload"], "Resource": "arn:aws:s3:::bucket-name/*" } ] } 

This may actually be redundant. Any other ideas?

Answer 1

Fiver's answer is not enough to run collectstatic in django-storages . I used everything @ jvc26 did except s3:ListAllMyBuckets . I would suggest that s3:ListBucketVersions not needed.

 { "Statement": [ { "Effect": "Allow", "Action": ["s3:ListBucket", "s3:GetBucketLocation", "s3:ListBucketMultipartUploads", "s3:ListBucketVersions"], "Resource": "arn:aws:s3:::bucket-name" }, { "Effect": "Allow", "Action": ["s3:*Object*", "s3:ListMultipartUploadParts", "s3:AbortMultipartUpload"], "Resource": "arn:aws:s3:::bucket-name/*" } ] } 

Answer 2

I am not 100% sure about django repositories, as I use cuddly-buddly , which is based on the S3 part of the django repository. I just found cuddlybuddly easier to use and worked better, plus the name is amazing!

Anyway, I have a project using Django + S3 and found the following AWS strategy as a minimum necessary for my project:

 { "Version": "2008-10-17", "Id": "Policy123", "Statement": [ { "Sid": "Stmt123", "Effect": "Allow", "Principal": { "AWS": "arn:aws:iam::some-aws-user" }, "Action": "s3:ListBucket", "Resource": "arn:aws:s3:::bucket-name" }, { "Sid": "Stmt234", "Effect": "Allow", "Principal": { "AWS": "arn:aws:iam::some-aws-user" }, "Action": [ "s3:DeleteObject", "s3:GetObject", "s3:PutObject" ], "Resource": "arn:aws:s3:::bucket-name/*" } ] } 

I have Django views that need to be loaded, retrieved, and deleted so that the relevant actions can be used / omitted based on your needs. Obviously, someone will need to change the username and bucket.

Also, for completeness, since this was not obvious to me, pay attention to the following limitations regarding AWS rules :

• Maximum policy size is 20 KB

• The value for the resource must have a bucket name prefix or bucket name and the path below it (bucket /). If only the bucket name is specified, without trailing /, the policy applies to the bucket.

• Each policy must have a unique policy identifier (Id)

• Each operator in the policy must have a unique operator identifier (sid)

• Each policy should cover only one bucket and resources within this bucket (when writing a policy, do not include statements that refer to other buckets or resources in other buckets)

Finally, to anyone, do not change the date value in the Version key; Amazon uses this value to analyze the policy format.

Hope this helps!

Answer 3

which works for me:

 { "Statement": [ { "Effect": "Allow", "Action": [ "s3:ListBucket", "s3:GetBucketLocation", "s3:ListBucketMultipartUploads", "s3:ListBucketVersions" ], "Resource": "arn:aws:s3:::bucket_name_here" }, { "Effect": "Allow", "Action": [ "s3:*Object*", "s3:ListMultipartUploadParts", "s3:AbortMultipartUpload" ], "Resource": "arn:aws:s3:::bucket_name_here/*" } ] }