IAM policy

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "ListObjectsInBucket",
            "Effect": "Allow",
            "Action": [
                "s3:ListBucket"
            ],
            "Resource": [
                "arn:aws:s3:::snip"
            ]
        },
        {
            "Sid": "AllObjectActions",
            "Effect": "Allow",
            "Action": "s3:*Object",
            "Resource": [
                "arn:aws:s3:::snip/*"
            ]
        }
    ]
}

Clojure code - this hangs on the list buckets op

(comment
  (def config (edn/read-string (slurp "resources/.secrets.edn")))
  (def s3 (aws/client {:api :s3
                       :credentials-provider (creds/default-credentials-provider (:s3 config))}))

  (aws/validate-requests s3 true)

  (aws/invoke s3 {:op :ListBuckets}))

The AWS docs are very sprawling, so I can't tell if it's the S3 side of things I'm messing up or the Clojure side (or both)

In particular I'm unclear on whether the IAM policy itself is sufficient, or whether I need to change the permissions on the Bucket itself also

Try aws cli https://awscli.amazonaws.com/v2/documentation/api/latest/reference/s3/ls.html Use it to test if policy setup is sufficient to do what you want. When you figure out policies you can reproduce aws cli commands in clojure

Thanks, I will give that a go

I’m not sure if you can use wildcards like this "Action": "s3:*Object"

I recommend trying with s3:* or by listing all the relevant operation names

This is the policy we use for dev buckets and it works

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": "s3:ListAllMyBuckets",
            "Resource": "arn:aws:s3:::*"
        },
        {
            "Effect": "Allow",
            "Action": [
                "s3:ListBucket",
                "s3:GetBucketLocation"
            ],
            "Resource": "arn:aws:s3:::dev-${aws:username}"
        },
        {
            "Effect": "Allow",
            "Action": [
                "s3:PutObject",
                "s3:PutObjectAcl",
                "s3:GetObject",
                "s3:GetObjectAcl",
                "s3:DeleteObject"
            ],
            "Resource": "arn:aws:s3:::dev-${aws:username}/*"
        }
    ]
}

Thanks, I got it figured - the cli wasn't able to ls because the IAM wasn't set up to allow it Also I wasn't setting the environment variables (the region). Once i corrected those it worked!