CODEWITHSUNDEEP
amazon-s3
Prasenjit Dhar
Prasenjit Dhar

Reputation: 41

Invalid ARN error while creating S3 Bucket Policy using Policy generator

Im trying to create Amazon S3 Bucket Policy using the Policy Generator Though this is very basic, but not sure why Im getting "Resource field is not valid. You must enter a valid ARN." for any ARN, eg for this "arn:aws:s3:::s3-demo-bucket-2022" I have tried with multiple s3 bucket, aws accounts, all giving same problem. Any help/suggestion?

Upvotes: 4

Views: 5314

Answers (1)

hackr
hackr

Reputation: 81

As in your case, I just tried using the AWS bucket policy generator (located here)to build a simple S3 bucket policy, but it did not recognize the AWS-generated ARN I entered for my bucket. I tried several times, and it did not work, so it appears that at this moment, there might be a bug in AWS's system that is causing the policy generator to not recognize valid ARNs for S3 buckets.

You may have to build your own bucket policy using AWS examples, and enter it under "Bucket policy" (within the "Permissions" tab) of your S3 bucket. For instance, if you want to configure your S3 bucket policy to host a publicly accessible static website (which must be enabled by clicking the appropriate tick box for your bucket in the AWS console), you might enter this JSON policy, which worked in my case:

{
"Version": "2012-10-17",
"Statement": [
    {
        "Sid": "Statement1",
        "Principal": "*",
        "Effect": "Allow",
        "Action": [
            "s3:GetObject"
            ],
        "Resource": ["arn:aws:s3:::yourbucketname/*"]
    }
  ]
}

If you go to edit the current policy (which might not yet exist), AWS will pre-populate most of this for you. Don't forget to add the "/*" to the end of your ARN (as I did here) if you want to specify access to the things IN the bucket as opposed to referring to the bucket itself.

Other JSON bucket policy examples are provided here by AWS: https://docs.aws.amazon.com/AmazonS3/latest/userguide/example-bucket-policies.html#example-bucket-policies-use-case-3

I have reported the bug in the policy generator website to AWS via my AWS console. I recommend you do the same so they will notice the problem and hopefully fix it.

Edit 1: I noticed you can bypass the apparent bug in the AWS Policy Generator by entering an asterisk ("*") where you would normally enter a specific S3 bucket ARN (the asterisk means 'any bucket'). This will enable you to finish building your policy, which you can edit near the end, inserting your specific bucket ARN in the place of the asterisk next to "Resource." So the editable policy will look something like this before you add your ARN (within double quotes and brackets as shown above):

{
  "Id": "Policy1656274053828",
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "Stmt1656274051729",
      "Action": [
        "s3:GetObject"
      ],
      "Effect": "Allow",
      "Resource": "*",
      "Principal": "*"
    }
  ]
}

Just copy and paste the JSON policy into the place where you need it.

Upvotes: 0

Related Questions