ECS Task Access Denied to S3

Question

I have an IAM role set for my task with the following permissions, yet I get access denied trying to access the buckets.

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "",
            "Effect": "Allow",
            "Action": "s3:*",
            "Resource": [
                "arn:aws:s3:::bucket/Templates/*",
                "arn:aws:s3:::bucket/*",
                "arn:aws:s3:::anotherBucket/*"
            ]
        }
    ]
}

The container instance has a role with the standard AmazonEC2ContainerServiceforEC2Role policy.

I seem to be able to read and write to folders under from bucket/ like bucket/00001, BUT I can't read from bucket/Templates.

Ive redeployed the permissions and the tasks repeatedly (using terraform) but nothing changes. Ive added logging to the app to ensure it's using the correct bucket and path / keys.

I'm stumped. Anyone got a clue what I might have missed here?

Thanks

PS: It just occurred to me, the files in the buckets I cant access I copy there using a script. This is done using credentials other than the creds the task is using.

aws s3 cp ..\Api\somefiles\000000000001\ s3://bucket/000000000001 --recursive --profile p aws s3 cp ..\Api\somefiles\Templates\000000000001\ s3://bucket/Templates/000000000001 --recursive --profile p

I was using -acl bucket-owner-full-control on the cp command but I removed that to see if would help - it didnt. Maybe I need something else?

Answer 1

Solved. Found an old sample from a previous employer :) I needed a permission for List* explicitly, separate from the other permissions. I also needed to define the sids.

"Version": "2012-10-17",
"Statement": [
    {
        "Sid": "sid1",
        "Effect": "Allow",
        "Action": [
            "s3:ListAllMyBuckets",
            "s3:ListBucket",
            "s3:HeadBucket"
        ],
        "Resource": "*"
    },
    {
        "Sid": "sid2",
        "Effect": "Allow",
        "Action": "s3:*",
        "Resource": "*"
    }
]

}

Answer 2

It works now because you changed the Resource to match "". Try adding the bucket itself as a resource, along with / pattern:

"Version": "2012-10-17",
"Statement": [
    {
        "Sid": "sid1",
        "Effect": "Allow",
        "Action": [
            "s3:ListAllMyBuckets",
            "s3:ListBucket",
            "s3:HeadBucket"
        ],
        "Resource": "*"
    },
    {
        "Sid": "sid2",
        "Effect": "Allow",
        "Action": "s3:*",
        "Resource": [
                "arn:aws:s3:::bucket",
                "arn:aws:s3:::bucket/*",
                "arn:aws:s3:::anotherBucket"
                "arn:aws:s3:::anotherBucket/*",
            ]
    }
]