Documentation Issue: "GetBucket" is not a policy action about ghost-storage-adapter-s3 HOT 6 CLOSED

In the end, I wound up not needing to do the Policy Generator step because I used CloudFront as my CDN. However, before I went that route, I was able to just give my IAM for the adapter the following roles and get things working:

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "VisualEditor0",
            "Effect": "Allow",
            "Action": "s3:ListBucket",
            "Resource": "arn:aws:s3:::my-s3-bucket.blog.assets"
        },
        {
            "Sid": "VisualEditor1",
            "Effect": "Allow",
            "Action": [
                "s3:PutObject",
                "s3:GetObjectAcl",
                "s3:GetObject",
                "s3:PutObjectVersionAcl",
                "s3:DeleteObject",
                "s3:PutObjectAcl"
            ],
            "Resource": "arn:aws:s3:::my-s3-bucket.blog.assets/*"
        }
    ]
}

One thing I ran into that should also be noted in the README is that: even if you give your blog these permissions and allow public ACL's on your S3 bucket, if your account follows AWS's recommendation of blocking public ACLs on S3 buckets it will override the per-bucket setting and then this adapter will be unable to set any ACL value other than private on new items. (Specifically, you'll get an "access denied" error in the logs.) That was what got me to switch to CloudFront in the end, though even there I have the same IAM policy as above so my adapter can continue writing to the bucket albeit now with the private ACL.

from ghost-storage-adapter-s3.

I have also run into it, not sure what to use

from ghost-storage-adapter-s3.

@christianreed do you have any thoughts on this?

from ghost-storage-adapter-s3.

Same here

from ghost-storage-adapter-s3.

Note that in this IAM policy we have both the ListBucket action on the bucket itself, and the GetObject action on the items in the bucket. I'm assuming one (or both?) of these is what was intended by the GetBucket permission in the README, which does not itself appear to exist.

from ghost-storage-adapter-s3.

@genuinezack Same here. With just IAM set up, it just works!

from ghost-storage-adapter-s3.