Configuring an IAM policy

To grant permissions to the S3 bucket, create an IAM (Identity and Access Management) policy or reuse an existing one.

Creating a new IAM policy
Updating an existing IAM policy

Skip this step if the policy was already configured for a previous deployment.

Creating a new IAM policy

Follow the steps below to create an IAM policy that grants permission to the S3 bucket.

To create an IAM policy:

Type “IAM” in the AWS console search box.
Select IAM in the search results to display the IAM dashboard.
Select Access management > Policies in the navigation sidebar.
In the content pane, click Create policy.
Click JSON in the Specify permissions section.

Paste the following JSON code in the Policy editor field.

 {
     "Version": "2012-10-17",
     "Statement": [
         {
             "Effect": "Allow",
             "Action": [
                 "s3:GetBucketLocation",
                 "s3:GetObject",
                 "s3:ListBucket"
             ],
             "Resource": [
                 "arn:aws:s3:::$S3_BUCKET_NAME",
                 "arn:aws:s3:::$S3_BUCKET_NAME/*"
             ]
         },
         {
             "Effect": "Allow",
             "Action": [
                 "ec2:ModifySnapshotAttribute",
                 "ec2:CopySnapshot",
                 "ec2:RegisterImage",
                 "ec2:Describe*"
             ],
             "Resource": "*"
         }
     ]
 }

In the JSON code, replace $S3_BUCKET_NAME with the name of the S3 bucket selected when Creating an S3 bucket.
Click Next.
Enter a name and an optional description for the new policy.
Click Create policy.

Updating an existing IAM policy

Follow the steps below to update an existing IAM policy that grants permission to the S3 bucket.

To update an IAM policy:

Type “IAM” in the AWS console search box.
Select IAM in the search results to display the IAM dashboard.
Select Access management > Policies in the navigation sidebar.
In the content pane, select the 🞧 expand button for an existing IAM policy.
Click Edit.
In the policy editor field, add the following code to the Resource array.
```
 "arn:aws:s3:::$S3_BUCKET_NAME",
 "arn:aws:s3:::$S3_BUCKET_NAME/*"
```
In the code, replace $S3_BUCKET_NAME with the name of the S3 bucket selected when Creating an S3 bucket.
Click Next.
Click Save changes.