title: Why is uploading a file to s3 via the C# AWS SDK giving a permission denied error?
body: <p>I am trying to enable our application to upload files to a specific S3 bucket.  The idea is to lock it down so if that application's access and secret keys get compromised malicious users can't do anything except upload new files.</p>
  
  <p>In order to do this I created a new IAM policy:</p>
  
  <pre><code>{
      "Version": "2012-10-17",
      "Statement": [
          {
              "Effect": "Allow",
              "Action": [
                  "s3:PutObject"
              ],
              "Resource": [
                  "arn:aws:s3:::app-dev-raw-uploads"
              ]
          }
      ]
  }
  </code></pre>
  
  <p>Next I saved the policy and went into the policy simulator and tested the S3 <code>PutObject</code> action against the <code>arn:aws:s3:::app-dev-raw-uploads</code> s3 bucket, and the simulator gave me an allowed/success result.</p>
  
  <p>I then created a new IAM user and attached that policy to the user and saved.  I then generated an access key and secret key for that user and plugged it into my application.  My application then attempted an upload with the following code:</p>
  
  <pre><code>    private static async Task PerformUpload(IIngestControllerSettings settings, string destinationPath, string sourcePath, CancellationToken cancellationToken)
      {
          var credentials = new BasicAWSCredentials(settings.AwsAccessKey, settings.AwsSecretKey);
          var region = RegionEndpoint.GetBySystemName(settings.AwsRegionName);
          var client = new AmazonS3Client(credentials, region);
          var fileTransferUtility = new TransferUtility(client);
  
          await fileTransferUtility.UploadAsync(sourcePath, settings.ArchivalStorageServiceContainerName, destinationPath, cancellationToken);
      }
  </code></pre>
  
  <p>This code works perfectly when I use my (temporary) personal AWS keys, but under this user's access/secret key I get:</p>
  
  <blockquote>
    <p>Amazon.S3.AmazonS3Exception: Access Denied ---> Amazon.Runtime.Internal.HttpErrorResponseException: The remote server returned an error: (403) Forbidden. ---> System.Net.WebException: The remote server returned an error: (403) Forbidden.</p>
  </blockquote>
  
  <p>Any idea on what I'm doing wrong?</p>
  
  <p><em>Edit:</em> Since I am able to upload files with the AWS CLI using these key credentials it seems like the AWS SDK <code>TransferUtility</code> class is requiring more permissions than just <code>PutObject</code> in order to upload files, but I can't find any reference as to what those would be.</p>