title: Correct S3 Policy For Pre-Signed URLs
body: <p>I need to issue pre-signed URLs for allowing users to GET and PUT files into a specific S3 bucket. I created an IAM user and use its keys to create the pre-signed URLs, and added a custom policy embedded in that user (see below). When I use the generated URL, I get an <code>AccessDenied</code> error with my policy. If I add the <code>FullS3Access</code> policy to the IAM user, the file can be GET or PUT with the same URL, so obviously, my custom policy is lacking. What is wrong with it?</p>
  
  <p>Here's the custom policy I am using that is not working:</p>
  
  <pre><code>{
      "Statement": [
          {
              "Action": [
                  "s3:ListBucket"
              ],
              "Effect": "Allow",
              "Resource": [
                  "arn:aws:s3:::MyBucket"
              ]
          },
          {
              "Action": [
                  "s3:AbortMultipartUpload",
                  "s3:CreateBucket",
                  "s3:DeleteBucket",
                  "s3:DeleteBucketPolicy",
                  "s3:DeleteObject",
                  "s3:GetBucketPolicy",
                  "s3:GetLifecycleConfiguration",
                  "s3:GetObject",
                  "s3:ListBucket",
                  "s3:ListBucketMultipartUploads",
                  "s3:ListMultipartUploadParts",
                  "s3:PutBucketPolicy",
                  "s3:PutLifecycleConfiguration",
                  "s3:PutObject"
              ],
              "Effect": "Allow",
              "Resource": [
                  "arn:aws:s3:::MyBucket/*"
              ]
          }
      ]
  }
  </code></pre>