We recommend using predefined roles for services rather than creating custom IAM policies, but if you want to create custom polices, use the roles described in the table below. Note that the specific policies required by the Amazon S3 driver are subject to change in future releases.

Amazon S3 requires at a minimum the following permissions:

IAM Role	Description
Tables: Buckets
SELECT	ListAllMyBuckets
INSERT	CreateBucket
DELETE	GetBucketLocation and DeleteBucket
Tables: Objects
SELECT	GetBucketLocation and ListBucket
DELETE	GetBucketLocation and DeleteObject
Views (All views require GetBucketLocation in addition to the permission listed below)
BucketsACL	ListBucket
BucketsAnalytics	GetAnalyticsConfiguration
BucketsCORS	GetBucketCORS
BucketsInventory	GetInventoryConfiguration
BucketsLifeCycle	GetLifecycleConfiguration
BucketsReplication	GetReplicationConfiguration
ObjectsACL	GetObjectAcl
PublicAccessBlock	GetBucketPublicAccessBlock
Stored Procedures (All procedures require GetBucketLocation in addition to the permission listed below)
CopyObject	GetObject at source bucket and PutObject at destination bucket
DownloadObjectTorrent	GetObjectTorrent
DownloadObjects	GetObject
UploadObjects	PutObject

JSON Example

A JSON version of a minimum permissions policy for full driver functionality is shown below.

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "VisualEditor0",
            "Effect": "Allow",
            "Action": [
                "s3:GetBucketPublicAccessBlock",
                "s3:GetLifecycleConfiguration",
                "s3:GetInventoryConfiguration",
                "s3:CreateBucket",
                "s3:ListBucket",
                "s3:GetReplicationConfiguration",
                "s3:PutObject",
                "s3:GetObjectAcl",
                "s3:GetObject",
                "s3:GetObjectTorrent",
                "s3:ListAllMyBuckets",
                "s3:GetBucketCORS",
                "s3:GetAnalyticsConfiguration",
                "s3:DeleteObject",
                "s3:GetBucketLocation",
                "s3:DeleteBucket"
            ],
            "Resource": "*"
        }
    ]"
}

In the above example, "Resource" is set to * to allow access to all buckets, but you can limit access to only one specific bucket.