silverstripe / silverstripe-s3

Silverstripe module to store assets in S3 rather than on the local filesystem (SS4/SS5 only)
BSD 3-Clause "New" or "Revised" License
20 stars 25 forks source link

Policy file no longer works on Amazon S3 #17

Closed Smashcat closed 5 years ago

Smashcat commented 6 years ago

Using the example policy file with placeholders replaced with existing bucket, results in an error "Invalid principle in policy". As example file appears to by 6 years old, it may need an update?

madmatt commented 5 years ago

Hey @Smashcat,

Thanks for the bug report. The version shown there is the version of IAM policy document (described here: https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_version.html) rather than the last time that bucket policy was written.

We have a hackday coming up at work next Friday, I'll try and get a new policy written then and update the module. Sorry for the delay!

obj63mc commented 5 years ago

Hi @madmatt and @Smashcat -

Below is what we use on our production sites so far and is what is auto generated from our S3 provider - bucketeer - https://elements.heroku.com/addons/bucketeer

{
    "Policy": {
        "Version":"2012-10-17,
        "Statement":[
            {
                "Sid":"AddPerm",
                "Effect":"Allow",
                "Principal":"*",
                "Action":"s3:GetObject",
                "Resource":"arn:aws:s3:::<bucket-name>/public/*"
            }
        ]
    }
}

If you would like to test this and all is good I can submit a pull request to update the README.md

madmatt commented 5 years ago

Yep that looks perfect to me, thanks @obj63mc!

madmatt commented 5 years ago

Resolved this via #23, and released in 0.4.0.