What's the minimum IAM s3 permissions needed (for sqlite + s3)?

[jcmsj]

I made an IAM policy with full s3 access to a specific bucket then attached that to a newly made IAM user+access key, but the app keeps resetting -> nothing gets stored in the bucket, and no relevant error msgs in vercel's deployment logs

the policy:

{
	"Version": "2012-10-17",
	"Statement": [
		{
			"Effect": "Allow",
			"Action": [
				"s3:*",
				"s3-object-lambda:*"
			],
			"Resource": "arn:aws:s3:::uhc-serverlesswp"
		}
	]
}

And just to double check, only the S3_SQLITE related env vars are needed?

[mitchmac]

Hi @jcmsj! Sorry I haven't documented the IAM policy requirements yet for the s3 + sqlite functionality.

All it needs is s3:GetObject and s3:PutObject but the resource needs to handle objects with /*.

Example:

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "s3:PutObject",
                "s3:GetObject"
            ],
            "Resource": "arn:aws:s3:::your-bucket-name/*"
        }
    ]
}

If using S3 for media storage as well, it will be a bit different depending on your needs and I recommend a separate bucket.
Please let me know how it goes for you.