Hi, I have setup image upload to aws S3. Its is working fine, but backup is not working with s3. I have created a new bucket for backup and added the bucket name in the admin panel. It gives me following error in logs, Aws::S3::Errors::AccessDenied (Access Denied) /var/www/discourse/vendor/bundle/ruby/2.4.0/gems/aws-sdk-core-3.6.0/lib/seahorse/client/plugins/raise_response_errors.rb:15:in `call' Do I need a second S3 bucket for backup? If so, do i need create a new policy for my new bucket and attach it to my IAM? Need some help guys!!

Unless Your AWS account is shared or Your Discouse is having multiple admins, it’s okay (but not recommended) to leave it to s3.* Because that potentially means full control over s3 service so the worse that someone could do is to create a bunch of buckets and upload data to them … But that will only happen if somehow Your IAM credentials are leaked.

Need some serious help…!! Anybody there?

[image] Pravi: Aws::S3::Errors::AccessDenied (Access Denied) as it clearly says access is denied! so The first thing that You could start investigating with is whether your IAM user has write access to that bucket or not! …

Thanks for the replay. I am new to aws S3 and struggling with it. Could please tell me how to do that? Do I need to create a new policy in order grant write access or should i add this already created policy? I am little confused ?

Do Some research on the AWS Docs about how to create a Policy for IAM users and then Grant The IAM user Read & Write (I Guess it’s Called Get & Put on amazon) Access to all the buckets, This way, You’ll be able to use the same IAM user on both buckets … or You can tweak the policy to explicitly state the buckets and the Access levels granted to the IAM user. Refer Edit IAM policies - AWS Identity and Access Management I’ve used AWS S3 in Past for a Client and Have been able to configure both, Backup Uploads and Image Uploads to S3 without much trouble. Though, I Used separate buckets at that time. I’ll try to recreate Your issue and Share my Findings but For now, I’d suggest Modifying Your IAM user so that it has necessary permissions on Buckets. Someone more experienced may perhaps be able to explain everything in more details.

Thanks for the quick response. I believe, I almost get it. I have one more doubt, since its a backup, which Action should I choose in my policy, "Action": "s3:*", or "Action": [ "s3:PutObject", "s3:GetObject", "s3:DeleteObject" ],

[image] Pravi: “Action”: [ “s3:PutObject”, “s3:GetObject”, “s3:DeleteObject” ], This should suffice but I’d suggest try a backup with [image] Pravi: “Action”: “s3:*”, and if that goes through successfully, try manual assignment of more restrictive policies.

create a new policy with “Action”: “s3:* and backup successfully created in the new bucket. Is their any need to restrict the permission for backup? Do you think “Action”: “s3:*” is fine for backup?

Thanks mate. You solved one of my problem in 2017. Happy new year!! :tada::fireworks::sparkler::confetti_ball:

Do I need a second aws S3 bucket for backup?

Product Support Self-hosting

Pravi (PK) December 31, 2017, 4:51pm 10

Thanks mate. You solved one of my problem in 2017.
Happy new year!!

Topic		Replies	Views
S3 Backup ... suspect access issue Product Support	3	1989	September 16, 2018
S3 image upload access denied while backups upload working fine Self-hosting s3	22	3029	March 23, 2020
Issues backing up to s3 Self-hosting backups , s3	4	1127	February 9, 2018
Policy and permission issues with s3 buckets? Self-hosting s3	20	4373	January 14, 2019
S3 Backup not working with EC2 IAM Self-hosting backups , s3	3	577	July 28, 2022

Do I need a second aws S3 bucket for backup?

Related topics