title: AWS S3 IAM policy for read and write permissions on a single bucket
body: <p>In Chapter 11.4.4 '<a href="https://www.railstutorial.org/book/user_microposts#sec-image_upload_in_production" rel="nofollow noreferrer">Image upload in production</a>' of Michael Hartl' Rails Tutorial it is suggested to use Amazon Web Services S3 as a cloud storage service. In a note at the bottom of the page, the author himself defines this section of the book as "challenging" and also suggests that it "can be skipped without loss of continuity".</p>
  
  <p>Indeed one of the most challenging parts of this section is to find a suitable IAM policy that can be attached to the IAM user at AWS in order to grant to the IAM user read and write permissions on the S3 bucket.</p>
  
  <p>I found that this at Stackoverflow is a common issue: see for instance '<a href="https://stackoverflow.com/questions/30350785/trying-to-set-up-amazons-s3-bucket-403-forbidden-error-setting-permissions">Trying to set up Amazon's S3 bucket: 403 Forbidden error &amp; setting permissions</a>'.</p>
  
  <p>In effect, <a href="http://blogs.aws.amazon.com/security/post/Tx3VRSWZ6B3SHAV/Writing-IAM-Policies-How-to-grant-access-to-an-Amazon-S3-bucket" rel="nofollow noreferrer">Amazon Web Services's solution</a> for applications that need read and write permissions on a single S3 bucket does not work, and the user who tries to upload images receives a 403 forbidden status from the AWS server at Heroku.</p>
  
  <p>The predefined 'AmazonS3FullAccess' policy works indeed, however it should not be considered as a definitive solution, because granting too many permissions to the IAM user, and therefore to the application, is not required and also, I suppose, can be a security bug.</p>
  
  <p>What then is the correct IAM policy?</p>