title: What policy would enable Lightsail to upload to a restricted S3 bucket?
body: <p>Since Lightsail instances are hosted from a dedicated AWS account different from the user's account, what would be a good S3 bucket policy to restrict bucket/object actions for a specific Lightsail instance?  Specifically, I would like to grant only <code>s3:PutObject</code> and <code>s3:ListBucket</code> actions to the instance.</p>
  
  <p>Or, is there another, better solution for granting access than the bucket policy?</p>