Boto3: aws credentials with limited permissions

Question

I was provisioned some AWS keys. These keys give me access to certain directories in a s3 bucket. I want to use boto3 to interact with the directories that were exposed to me, however it seems that I can't actually do anything with the bucket at all, since I don't have access to the entire bucket.

This works for me from my terminal:

aws s3 ls s3://the_bucket/and/this/specific/path/

but if I do:

aws s3 ls s3://the_bucket/

I get:

An error occurred (AccessDenied) when calling the ListObjects operation: Access Denied

which also happens when I try to access the directory via boto3.

session = boto3.Session(profile_name=my_creds)
client=session.client('s3')
list_of_objects = client.list_objects(Bucket='the_bucket', Prefix='and/this/specific/path', Delimiter='/')

Do I need to request access to the entire bucket for boto3 to be usable?

Answer 1

You need to set this Bucket Policy:

{
  "Sid": "<SID>",
  "Effect": "Allow",
  "Principal": {
    "AWS": "arn:aws:iam::<account>:user/<user_name>"
  },
  "Action": [
    "s3:GetBucketLocation",
    "s3:ListBucket"
  ],
  "Resource": "arn:aws:s3:::<bucket_name>"
}

For more information about Specifying Permissions in a Policy