# S3 Backup ... suspect access issue
**URL:** https://meta.discourse.org/t/s3-backup-suspect-access-issue/97134
**Category:** Support
**Created:** [September 13, 2018, 5:52pm UTC](https://meta.discourse.org/t/s3-backup-suspect-access-issue/97134 "2018-09-13T17:52:54Z")
**Posts on this page:** 5
**Page:** 1
### Author:  [@merefield](https://meta.discourse.org/u/merefield)
#### Post date: [September 13, 2018, 5:52pm UTC](https://meta.discourse.org/t/s3-backup-suspect-access-issue/97134/1 "2018-09-13T17:52:54Z")
Getting an Access Denied issue in error log … which seems to be causing Sidekiq to stay paused after backups!! (which is interesting on its own) - is my access policy on IAM not generous enough?:
```plaintext
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": [
"s3:GetBucketLocation",
"s3:ListAllMyBuckets"
],
"Resource": "*"
},
{
"Effect": "Allow",
"Action": [
"s3:ListBucket"
],
"Resource": [
"arn:aws:s3:::my-discourse-backups"
]
},
{
"Effect": "Allow",
"Action": [
"s3:PutObject",
"s3:GetObject"
],
"Resource": [
"arn:aws:s3:::my-discourse-backups/*"
]
}
]
}
```
---
### Author:  [@merefield](https://meta.discourse.org/u/merefield)
#### Post date: [September 13, 2018, 6:01pm UTC](https://meta.discourse.org/t/s3-backup-suspect-access-issue/97134/2 "2018-09-13T18:01:52Z")
Going to try an element of this policy here:
> [@IAM and bucket policy for S3 access](https://meta.discourse.org/t/iam-and-bucket-policy-for-s3-access/87222):
>
> I noticed that all of the tutorials i found for Discourse S3 access granted the user absolute authority over the bucket – they allow ‘s3:\*’ authority. This is an extremely unwise policy, since it allows significantly more control over the bucket than is reasonable. Should you be using S3 for Discourse backup storage, a rampaging attacker would be able to delete your bucket and your backups on the way out. There are two ways to combat this: One, a tighter policy… { "Version": "2012-10-17",…
---
### Author:  [@merefield](https://meta.discourse.org/u/merefield)
#### Post date: [September 13, 2018, 6:14pm UTC](https://meta.discourse.org/t/s3-backup-suspect-access-issue/97134/3 "2018-09-13T18:14:37Z")
Went with policy in the guide, will monitor for a few days before accepting this as solution:
> [@Set up file and image uploads to S3](https://meta.discourse.org/t/setting-up-file-and-image-uploads-to-s3/7229):
>
> So, you want to use S3 to handle image uploads? Here’s the definitive guide, but also see [Configure an S3 compatible object storage provider for uploads](https://meta.discourse.org/t/configure-an-s3-compatible-object-storage-provider-for-uploads/148916) to see how to configure your app.yml. S3 registration Head over to [https://aws.amazon.com/free/](https://aws.amazon.com/free/) and click on [Create a Free Account] During the create account process, make sure you provide payment information, otherwise you won’t be able to use S3. There’s no registration fee, you will only be charged for [what you use](https://aws.amazon.com/s3/pricing/), if you exceed the [AWS …](https://aws.amazon.com/free/)
---
### Author:  [@merefield](https://meta.discourse.org/u/merefield)
#### Post date: [September 16, 2018, 11:31am UTC](https://meta.discourse.org/t/s3-backup-suspect-access-issue/97134/4 "2018-09-16T11:31:14Z")
Actually had to use a slightly different policy to make mine work,
I had to add:
```
"s3:GetBucketLocation",
```
my top level one now looks like:
```plaintext
"Statement": [
{
"Effect": "Allow",
"Action": [
"s3:HeadBucket",
"s3:GetBucketLocation",
"s3:ListAllMyBuckets"
],
"Resource": "*"
},
```
But otherwise based on:
> [@Set up file and image uploads to S3](https://meta.discourse.org/t/setting-up-file-and-image-uploads-to-s3/7229):
>
> So, you want to use S3 to handle image uploads? Here’s the definitive guide, but also see [Configure an S3 compatible object storage provider for uploads](https://meta.discourse.org/t/configure-an-s3-compatible-object-storage-provider-for-uploads/148916) to see how to configure your app.yml. S3 registration Head over to [https://aws.amazon.com/free/](https://aws.amazon.com/free/) and click on [Create a Free Account] During the create account process, make sure you provide payment information, otherwise you won’t be able to use S3. There’s no registration fee, you will only be charged for [what you use](https://aws.amazon.com/s3/pricing/), if you exceed the [AWS …](https://aws.amazon.com/free/)
---
### Author:  [@system](https://meta.discourse.org/u/system)
#### Post date: [October 16, 2018, 11:41am UTC](https://meta.discourse.org/t/s3-backup-suspect-access-issue/97134/5 "2018-10-16T11:41:44Z")
This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.