[Fixed]-What permissions does django-storages require for an s3 IAM user?

I’m not 100% sure about django-storages, as I use cuddly-buddly which is based on the S3 portion of django-storages. I just found cuddlybuddly simpler to use and worked better, plus the name is awesome!

Anyway, I have a project using Django+S3 and found the following AWS policy as the minimum required for my project:

{
  "Version": "2008-10-17",
  "Id": "Policy123",
  "Statement": [
    {
      "Sid": "Stmt123",
      "Effect": "Allow",
      "Principal": {
        "AWS": "arn:aws:iam::some-aws-user"
      },
      "Action": "s3:ListBucket",
      "Resource": "arn:aws:s3:::bucket-name"
    },
    {
      "Sid": "Stmt234",
      "Effect": "Allow",
      "Principal": {
        "AWS": "arn:aws:iam::some-aws-user"
      },
      "Action": [
        "s3:DeleteObject",
        "s3:GetObject",
        "s3:PutObject"
      ],
      "Resource": "arn:aws:s3:::bucket-name/*"
    }
  ]
}

I have Django views that need to upload, retrieve, and delete so those corresponding actions can be used/omitted based on your needs. Obviously, anyone will need to change the user and bucket name.

Also, just for completeness as it wasn’t obvious to me, note the following restrictions regarding AWS policies:

• The maximum size of a policy is 20 KB

• The value for Resource must be prefixed with the bucket name or the
  bucket name and a path under it (bucket/). If only the bucket name is
  specified, without the trailing /, the policy applies to the bucket.

• Each policy must have a unique policy ID (Id)

• Each statement in a policy must have a unique statement ID (sid)

• Each policy must cover only a single bucket and resources within that
  bucket (when writing a policy, don’t include statements that refer to
  other buckets or resources in other buckets)

Finally, to anyone tempted to do so, don’t change the date value in the Version key, Amazon uses this value to parse the policy format.

Hope this helps!

Refer to official Django Storages official documentation here: https://django-storages.readthedocs.io/en/latest/backends/amazon-S3.html#iam-policy

You can simply copy and paste that permission into you IAM policy.

that works for me:

{
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "s3:ListBucket",
                "s3:GetBucketLocation",
                "s3:ListBucketMultipartUploads",
                "s3:ListBucketVersions"
            ],
            "Resource": "arn:aws:s3:::bucket_name_here"
        },
        {
            "Effect": "Allow",
            "Action": [
                "s3:*Object*",
                "s3:ListMultipartUploadParts",
                "s3:AbortMultipartUpload"
            ],
            "Resource": "arn:aws:s3:::bucket_name_here/*"
        }
    ]
}

I think no matter you use IAM, or other type of permissions, a worldwide read access should be given. So I got succeeded with this configuration:

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "PublicReadGetObject",
            "Effect": "Allow",
            "Principal": "*",
            "Action": "s3:GetObject",
            "Resource": [
                "arn:aws:s3:::buuuuu",
                "arn:aws:s3:::buuuuu/*"
            ]
        }
    ]
}