Question

A CloudOps engineer is troubleshooting access for a developer who cannot upload objects to an S3 bucket. The developer is a member of an IAM group that has an attached policy allowing s3:PutObject on the bucket. The bucket policy also allows the developer's IAM user to perform s3:PutObject. However, a permissions boundary attached to the IAM user allows only s3:GetObject and s3:ListBucket. What is the reason the upload is failing?

Accepted Answer

The permissions boundary limits the user's maximum permissions to only the actions it allows, so s3:PutObject is not effectively granted.

Answer

Bucket policies always override IAM identity-based policies, and the bucket policy is missing an explicit s3:PutObject grant.

Answer

IAM group policies do not apply to individual users unless the user is also granted the same policy directly.

Answer

The permissions boundary grants additional permissions, so PutObject should work; the failure must be caused by a bucket ACL.