S3 -> Principle of least privilege

[maluio]

This looks really promising and works well when granting the AmazonS3FullAccess policy to the AWS user according to the docs.

However, I was wondering if it would be possible to grant only the least amount of permissions needed.

So far I have got:

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "VisualEditor0",
            "Effect": "Allow",
            "Action": "s3:GetBucketLocation",
            "Resource": "arn:aws:s3:::<BUCKET>"
        },
        {
            "Sid": "VisualEditor1",
            "Effect": "Allow",
            "Action": [
                "s3:PutObject",
                "s3:GetObject"
            ],
            "Resource": [
                "arn:aws:s3:::<BUCKET>/*",
                "arn:aws:s3:::<BUCKET>"
            ]
        }
    ]
}

But when doing a litestream replicate I get

monitor error: AccessDenied: Access Denied
	status code: 403

Or is AmazonS3FullAccess the only way to go?

Thanks a lot !

[benbjohnson]

Hi Martin, I can do some research & testing to get a minimum policy. At first glance, I think what might be missing in your policy is ListBucket.

I added an issue for a setup guide for S3 as well: #76

[maluio]

Thank for the very fast response.

It works with the added ListBucket action. (I have only tested litestream replicate, but I guess the other commands will work fine, too)

Here is the working policy:

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "VisualEditor0",
            "Effect": "Allow",
            "Action": [
                "s3:GetBucketLocation",
                "s3:ListBucket"
            ],
            "Resource": "arn:aws:s3:::<BUCKET>"
        },
        {
            "Sid": "VisualEditor1",
            "Effect": "Allow",
            "Action": [
                "s3:PutObject",
                "s3:GetObject"
            ],
            "Resource": [
                "arn:aws:s3:::<BUCKET>/*",
                "arn:aws:s3:::<BUCKET>"
            ]
        }
    ]
}

[benbjohnson]

Awesome! Thanks for testing that out. I think ideally it would be great to have a policy for the server for replication and then a separate read-only policy for users who want to restore. For example, a developer who needs a snapshot of staging/production to debug an issue locally.