Document minimum AMI user permissions/ACLs in order for accesssing an AWS bucket

Took me awhile to sort this out, and was surprised that I couldn’t find a record of it in the issue queue. Copy-pasting this in to the JSON editor allowed it to finally work: https://docs.aws.amazon.com/AmazonS3/latest/dev/example-policies-s3.html#iam-policy-ex0

{
   "Version":"2012-10-17",
   "Statement":[
      {
         "Effect":"Allow",
         "Action": "s3:ListAllMyBuckets",
         "Resource":"arn:aws:s3:::*"
      },
      {
         "Effect":"Allow",
         "Action":["s3:ListBucket","s3:GetBucketLocation"],
         "Resource":"arn:aws:s3:::awsexamplebucket1"
      },
      {
         "Effect":"Allow",
         "Action":[
            "s3:PutObject",
            "s3:PutObjectAcl",
            "s3:GetObject",
            "s3:GetObjectAcl",
            "s3:DeleteObject"
         ],
         "Resource":"arn:aws:s3:::awsexamplebucket1/*"
      }
   ]
}

Giving full S3 permissions on the bucket also worked, but that felt like overkill, and it would be bad to incentivize users to do that.

[patcon]

Ok, after some experimentation, found the minimal permissions for bucket and plugin setup is:

{
  s3Options: {
    // ...
  },
  s3UploadOptions: {
    ACL: '',
    Bucket: 'YOURBUCKET'
  }
}

IAM > Users > YOURUSER > Permissions > Add inline policy (JSON):

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "s3:PutObject"
            ],
            "Resource": "arn:aws:s3:::YOURBUCKET/*"
        }
    ]
}

S3 > YOURBUCKET > Permissions > Block public access: All “OFF”

S3 > YOURBUCKET > Permissions > Bucket Policy:

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "AllowPublicRead",
            "Effect": "Allow",
            "Principal": {
                "AWS": "*"
            },
            "Action": "s3:GetObject",
            "Resource": "arn:aws:s3:::YOURBUCKET/*"
        }
    ]
}

[patcon]

This is really helpful @SunSparc 😃 I’ll try to upstream a doc change when I’m next using this plugin