{"action":"created","issue":{"url":"https://api.github.com/repos/joshdholtz/fastlane-plugin-s3/issues/76","repository_url":"https://api.github.com/repos/joshdholtz/fastlane-plugin-s3","labels_url":"https://api.github.com/repos/joshdholtz/fastlane-plugin-s3/issues/76/labels{/name}","comments_url":"https://api.github.com/repos/joshdholtz/fastlane-plugin-s3/issues/76/comments","events_url":"https://api.github.com/repos/joshdholtz/fastlane-plugin-s3/issues/76/events","html_url":"https://github.com/joshdholtz/fastlane-plugin-s3/issues/76","id":456413072,"node_id":"MDU6SXNzdWU0NTY0MTMwNzI=","number":76,"title":"AWS S3 access denied error when trying to push a build to S3","user":{"login":"ram-nadella","id":583956,"node_id":"MDQ6VXNlcjU4Mzk1Ng==","avatar_url":"https://avatars0.githubusercontent.com/u/583956?v=4","gravatar_id":"","url":"https://api.github.com/users/ram-nadella","html_url":"https://github.com/ram-nadella","followers_url":"https://api.github.com/users/ram-nadella/followers","following_url":"https://api.github.com/users/ram-nadella/following{/other_user}","gists_url":"https://api.github.com/users/ram-nadella/gists{/gist_id}","starred_url":"https://api.github.com/users/ram-nadella/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/ram-nadella/subscriptions","organizations_url":"https://api.github.com/users/ram-nadella/orgs","repos_url":"https://api.github.com/users/ram-nadella/repos","events_url":"https://api.github.com/users/ram-nadella/events{/privacy}","received_events_url":"https://api.github.com/users/ram-nadella/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":0,"created_at":"2019-06-14T20:04:36Z","updated_at":"2019-06-29T03:50:13Z","closed_at":null,"author_association":"NONE","body":"Hi,\r\n\r\nThank you for creating and maintaining this plugin.\r\n\r\nI've managed to get this plugin working using my personal AWS credentials to get an iOS app build uploaded to S3.\r\n\r\nWe're working on getting this setup in CI (Circle) and would like to create a dedicated IAM user for use in CI with the bare minimum AWS permissions to allow builds to be uploaded to S3. Before we get this into CI, I am testing with the credentials on my machine, so any CI related factors are not at play here.\r\n\r\nI am running into `Aws::S3::Errors::AccessDenied: [!] Access Denied` error after a few attempts trying to set the right permissions on the new IAM account. Wanted to share what I have and try to get help from the community on S3 permissions that work.\r\n\r\nWe have a bucket dedicated to builds, let's call it `bucket-name` and the permissions I've tried are as follows, based on this [S3 help doc](https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_examples_s3_rw-bucket.html):\r\n\r\n```json\r\n{\r\n    \"Version\": \"2012-10-17\",\r\n    \"Statement\": [\r\n        {\r\n            \"Sid\": \"VisualEditor0\",\r\n            \"Effect\": \"Allow\",\r\n            \"Action\": \"s3:ListBucket\",\r\n            \"Resource\": \"arn:aws:s3:::bucket-name\"\r\n        },\r\n        {\r\n            \"Sid\": \"VisualEditor1\",\r\n            \"Effect\": \"Allow\",\r\n            \"Action\": \"s3:*Object\",\r\n            \"Resource\": \"arn:aws:s3:::bucket-name/*\"\r\n        }\r\n    ]\r\n}\r\n```\r\n\r\nI was still getting the access denied error and so I expanded the permissions to allow the client to be able to list buckets (as per [AWS docs](https://aws.amazon.com/blogs/security/writing-iam-policies-how-to-grant-access-to-an-amazon-s3-bucket/)):\r\n\r\n```json\r\n{\r\n    \"Version\": \"2012-10-17\",\r\n    \"Statement\": [\r\n        {\r\n            \"Sid\": \"VisualEditor0\",\r\n            \"Effect\": \"Allow\",\r\n            \"Action\": \"s3:ListBucket\",\r\n            \"Resource\": \"arn:aws:s3:::bucket-name\"\r\n        },\r\n        {\r\n            \"Sid\": \"VisualEditor1\",\r\n            \"Effect\": \"Allow\",\r\n            \"Action\": \"s3:*Object\",\r\n            \"Resource\": \"arn:aws:s3:::bucket-name/*\"\r\n        },\r\n        {\r\n            \"Sid\": \"VisualEditor2\",\r\n            \"Effect\": \"Allow\",\r\n            \"Action\": \"s3:ListAllMyBuckets\",\r\n            \"Resource\": \"*\"\r\n        }\r\n        {\r\n            \"Sid\": \"VisualEditor3\",\r\n            \"Effect\": \"Allow\",\r\n            \"Action\": \"s3:GetBucketLocation\",\r\n            \"Resource\": \"*\"\r\n        }\r\n    ]\r\n}\r\n```\r\n\r\nBut I am still getting the same error:\r\n\r\n```\r\nAws::S3::Errors::AccessDenied: [!] Access Denied\r\n```\r\n\r\nAny help would be much appreciated!\r\n\r\nEnvironment:\r\n\r\n```\r\n$ ruby --version\r\nruby 2.6.3p62 (2019-04-16 revision 67580) [x86_64-darwin18]\r\n$ bundle list | grep aws\r\n  * aws-eventstream (1.0.3)\r\n  * aws-sdk (2.11.292)\r\n  * aws-sdk-core (2.11.292)\r\n  * aws-sdk-resources (2.11.292)\r\n  * aws-sigv4 (1.1.0)\r\n  * fastlane-plugin-aws_s3 (1.6.0)\r\n$ bundle list | grep fastlane\r\n  * commander-fastlane (4.4.6)\r\n  * fastlane (2.125.2)\r\n  * fastlane-plugin-aws_s3 (1.6.0)\r\n$\r\n```"},"comment":{"url":"https://api.github.com/repos/joshdholtz/fastlane-plugin-s3/issues/comments/506923608","html_url":"https://github.com/joshdholtz/fastlane-plugin-s3/issues/76#issuecomment-506923608","issue_url":"https://api.github.com/repos/joshdholtz/fastlane-plugin-s3/issues/76","id":506923608,"node_id":"MDEyOklzc3VlQ29tbWVudDUwNjkyMzYwOA==","user":{"login":"matthewweldon","id":1388193,"node_id":"MDQ6VXNlcjEzODgxOTM=","avatar_url":"https://avatars1.githubusercontent.com/u/1388193?v=4","gravatar_id":"","url":"https://api.github.com/users/matthewweldon","html_url":"https://github.com/matthewweldon","followers_url":"https://api.github.com/users/matthewweldon/followers","following_url":"https://api.github.com/users/matthewweldon/following{/other_user}","gists_url":"https://api.github.com/users/matthewweldon/gists{/gist_id}","starred_url":"https://api.github.com/users/matthewweldon/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/matthewweldon/subscriptions","organizations_url":"https://api.github.com/users/matthewweldon/orgs","repos_url":"https://api.github.com/users/matthewweldon/repos","events_url":"https://api.github.com/users/matthewweldon/events{/privacy}","received_events_url":"https://api.github.com/users/matthewweldon/received_events","type":"User","site_admin":false},"created_at":"2019-06-29T03:50:13Z","updated_at":"2019-06-29T03:50:13Z","author_association":"NONE","body":"this is also happening to me:\r\n`Aws::S3::Errors::AccessDenied: [!] Access Denied`\r\n\r\nHere's my action\r\n```\r\naws_s3(\r\n               access_key: ENV[\"S3_ACCESS_KEY\"],  \r\n               secret_access_key: ENV[\"S3_SECRET_ACCESS_KEY\"], \r\n               bucket: ENV[\"S3_BUCKET\"],\r\n               region: \"ca-central-1\",\r\n               server_side_encryption:  \"AES256\",\r\n               upload_metadata: true,\r\n               )\r\n```\r\nI've triple checked all those environment variables and can upload files directly with the same credentials, not sure where to go now. "}}
{"actor":{"display_login":"matthewweldon"}}