An error occurred accessdenied when calling the createmultipartupload operation access denied

I want to use django-storages to store my model files in Amazon S3 but I get Access Denied error. I have granted the user almost all S3 permission PutObject, ListBucketMultipartUploads, ListMultipartUploadParts, AbortMultipartUpload permissions, etc. on all resources but this didn’t fix it.

settings.py

...
DEFAULT_FILE_STORAGE = 'storages.backends.s3boto3.S3Boto3Storage'
AWS_S3_REGION_NAME = 'eu-west-1'
AWS_S3_CUSTOM_DOMAIN = 'www.xyz.com'
AWS_DEFAULT_ACL = None
AWS_STORAGE_BUCKET_NAME = 'www.xyz.com'
...

Using the Django shell, I tried to use the storage system as shown below.

Python 3.6.6 (default, Sep 12 2018, 18:26:19)
[GCC 8.0.1 20180414 (experimental) [trunk revision 259383]] on linux
Type "help", "copyright", "credits" or "license" for more information.
(InteractiveConsole)
>>> import os
>>> AWS_ACCESS_KEY_ID = os.environ.get( 'AWS_ACCESS_KEY_ID', 'anything' )
>>> AWS_SECRET_ACCESS_KEY = os.environ.get( 'AWS_SECRET_ACCESS_KEY', 'anything' )
>>> AWS_DEFAULT_ACL = 'public-read'
>>> from django.core.files.storage import default_storage
>>> file = default_storage.open('test', 'w')
...
>>> file.write('storage contents')
2018-09-27 16:41:42,596 botocore.hooks [DEBUG] Event before-parameter-build.s3.CreateMultipartUpload: calling handler <function validate_ascii_metadata at 0x7fdb5e848d08>
2018-09-27 16:41:42,596 botocore.hooks [DEBUG] Event before-parameter-build.s3.CreateMultipartUpload: calling handler <function sse_md5 at 0x7fdb5e848158>
2018-09-27 16:41:42,597 botocore.hooks [DEBUG] Event before-parameter-build.s3.CreateMultipartUpload: calling handler <function validate_bucket_name at 0x7fdb5e8480d0>
2018-09-27 16:41:42,597 botocore.hooks [DEBUG] Event before-parameter-build.s3.CreateMultipartUpload: calling handler <bound method S3RegionRedirector.redirect_from_cache of <botocore.utils.S3RegionRedirector object at 0x7fdb5c5d1128>>
2018-09-27 16:41:42,597 botocore.hooks [DEBUG] Event before-parameter-build.s3.CreateMultipartUpload: calling handler <function generate_idempotent_uuid at 0x7fdb5e846c80>
2018-09-27 16:41:42,598 botocore.hooks [DEBUG] Event before-call.s3.CreateMultipartUpload: calling handler <function add_expect_header at 0x7fdb5e848598>
2018-09-27 16:41:42,598 botocore.hooks [DEBUG] Event before-call.s3.CreateMultipartUpload: calling handler <bound method S3RegionRedirector.set_request_url of <botocore.utils.S3RegionRedirector object at 0x7fdb5c5d1128>>
2018-09-27 16:41:42,598 botocore.endpoint [DEBUG] Making request for OperationModel(name=CreateMultipartUpload) with params: {'url_path': '/www.xyz.com/test?uploads', 'query_string': {}, 'method': 'POST', 'headers': {'Content-Type': 'application/octet-stream', 'User-Agent': 'Boto3/1.7.80 Python/3.6.6 Linux/4.14.67-66.56.amzn1.x86_64 Botocore/1.11.1 Resource'}, 'body': b'', 'url': 'https://s3.eu-west-1.amazonaws.com/www.xyz.com/test?uploads', 'context': {'client_region': 'eu-west-1', 'client_config': <botocore.config.Config object at 0x7fdb5c8e80b8>, 'has_streaming_input': False, 'auth_type': None, 'signing': {'bucket': 'www.xyz.com'}}}
2018-09-27 16:41:42,599 botocore.hooks [DEBUG] Event request-created.s3.CreateMultipartUpload: calling handler <bound method RequestSigner.handler of <botocore.signers.RequestSigner object at 0x7fdb5c8db780>>
2018-09-27 16:41:42,599 botocore.hooks [DEBUG] Event choose-signer.s3.CreateMultipartUpload: calling handler <bound method ClientCreator._default_s3_presign_to_sigv2 of <botocore.client.ClientCreator object at 0x7fdb5cabff98>>
2018-09-27 16:41:42,599 botocore.hooks [DEBUG] Event choose-signer.s3.CreateMultipartUpload: calling handler <function set_operation_specific_signer at 0x7fdb5e846b70>
2018-09-27 16:41:42,599 botocore.hooks [DEBUG] Event before-sign.s3.CreateMultipartUpload: calling handler <function fix_s3_host at 0x7fdb5e983048>
2018-09-27 16:41:42,600 botocore.utils [DEBUG] Checking for DNS compatible bucket for: https://s3.eu-west-1.amazonaws.com/www.xyz.com/test?uploads
2018-09-27 16:41:42,600 botocore.utils [DEBUG] Not changing URI, bucket is not DNS compatible: www.xyz.com
2018-09-27 16:41:42,601 botocore.auth [DEBUG] Calculating signature using v4 auth.
2018-09-27 16:41:42,601 botocore.auth [DEBUG] CanonicalRequest:
POST
/www.xyz.com/test
uploads=
content-type:application/octet-stream
host:s3.eu-west-1.amazonaws.com
x-amz-content-sha256:e3b0c44298fc1c149afbf343ddd27ae41e4649b934ca495991b7852b855
x-amz-date:20180927T164142Z

content-type;host;x-amz-content-sha256;x-amz-date
e3b0c44298fc1c149afb65gdfg33441e4649b934ca495991b7852b855
2018-09-27 16:41:42,601 botocore.auth [DEBUG] StringToSign:
AWS4-HMAC-SHA256
20180927T164142Z
20180927/eu-west-1/s3/aws4_request
8649ef591fb64412e923359a4sfvvffdd6d00915b9756d1611b38e346ae
2018-09-27 16:41:42,602 botocore.auth [DEBUG] Signature:
61db9afe5f87730a75692af5a95ggffdssd6f4e8e712d85c414edb14f
2018-09-27 16:41:42,602 botocore.endpoint [DEBUG] Sending http request: <AWSPreparedRequest stream_output=False, method=POST, url=https://s3.eu-west-1.amazonaws.com/www.xyz.com/test?uploads, headers={'Content-Type': b'application/octet-stream', 'User-Agent': b'Boto3/1.7.80 Python/3.6.6 Linux/4.14.67-66.56.amzn1.x86_64 Botocore/1.11.1 Resource', 'X-Amz-Date': b'20180927T164142Z', 'X-Amz-Content-SHA256': b'e3b0c44298fc1c149afbf4c8996fbdsdsffdss649b934ca495991b7852b855', 'Authorization': b'AWS4-HMAC-SHA256 Credential=X1234567890/20180927/eu-west-1/s3/aws4_request, SignedHeaders=content-type;host;x-amz-content-sha256;x-amz-date, Signature=61db9afe5f87730a7sdfsdfs20b7137cf5d6f4e8e712d85c414edb14f', 'Content-Length': '0'}>
2018-09-27 16:41:42,638 botocore.parsers [DEBUG] Response headers: {'x-amz-request-id': '9E879E78E4883471', 'x-amz-id-2': 'ZkCfOMwLoD08Yy4Nzfxsdfdsdfds3y9wLxzqFw+o3175I+QEdtdtAi8vIEH1vi9iq9VGUC98GqlE=', 'Content-Type': 'application/xml', 'Transfer-Encoding': 'chunked', 'Date': 'Thu, 27 Sep 2018 16:41:42 GMT', 'Server': 'AmazonS3'}
2018-09-27 16:41:42,639 botocore.parsers [DEBUG] Response body:
b'<?xml version="1.0" encoding="UTF-8"?>n<Error><Code>AccessDenied</Code><Message>Access Denied</Message><RequestId>9E879E78E4883471</RequestId><HostId>ZkCfOMwLoD08Yy4Nzfxo8RpzsdfsdfsxzqFw+o3175I+QEdtdtAi8vIEH1vi9iq9VGUC98GqlE=</HostId></Error>'
2018-09-27 16:41:42,639 botocore.hooks [DEBUG] Event needs-retry.s3.CreateMultipartUpload: calling handler <botocore.retryhandler.RetryHandler object at 0x7fdb5c618ac8>
2018-09-27 16:41:42,640 botocore.retryhandler [DEBUG] No retry needed.
2018-09-27 16:41:42,640 botocore.hooks [DEBUG] Event needs-retry.s3.CreateMultipartUpload: calling handler <bound method S3RegionRedirector.redirect_from_error of <botocore.utils.S3RegionRedirector object at 0x7fdb5c5d1128>>
Traceback (most recent call last):
  File "<console>", line 1, in <module>
  File "/usr/local/lib/python3.6/dist-packages/storages/backends/s3boto3.py", line 127, in write
    self._multipart = self.obj.initiate_multipart_upload(**parameters)
  File "/usr/local/lib/python3.6/dist-packages/boto3/resources/factory.py", line 520, in do_action
    response = action(self, *args, **kwargs)
  File "/usr/local/lib/python3.6/dist-packages/boto3/resources/action.py", line 83, in __call__
    response = getattr(parent.meta.client, operation_name)(**params)
  File "/usr/local/lib/python3.6/dist-packages/botocore/client.py", line 314, in _api_call
    return self._make_api_call(operation_name, kwargs)
  File "/usr/local/lib/python3.6/dist-packages/botocore/client.py", line 612, in _make_api_call
    raise error_class(parsed_response, operation_name)
botocore.exceptions.ClientError: An error occurred (AccessDenied) when calling the CreateMultipartUpload operation: Access Denied

These are the versions I’m using.

boto3==1.7.80
botocore==1.11.1
Django==2.1
s3transfer==0.1.13
django-storages==1.7.1

Why is it raising an exception?

I’m doing multipart upload via aws cli console but getting this error;

A client error (AccessDenied) occurred when calling the CreateMultipartUpload operation: Access Denied

Below is my policy, am I missing something in there?

Thanks.

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "s3:ListAllMyBuckets"
            ],
            "Resource": "arn:aws:s3:::*"
        },
        {
            "Effect": "Allow",
            "Action": [
                "s3:ListBucket",
                "s3:GetBucketLocation"
            ],
            "Resource": "arn:aws:s3:::mybucket"
        },
        {
            "Effect": "Allow",
            "Action": [
                "s3:PutObject",
                "s3:GetObject",
                "s3:DeleteObject",
                "s3:CreateMultipartUpload",
                "s3:AbortMultipartUpload",
                "s3:ListMultipartUploadParts",
                "s3:ListBucketMultipartUploads"
            ],
            "Resource": "arn:aws:s3:::mybucket/*"
        }
    ]
}

DVC tutorial — error pushing data to the cloud #1231

In section 4.1, «Pushing data to the cloud», I am running into the following error:
dvc push
Warning: Using obsoleted config format. Consider updating.
Preparing to push data to s3://dvc-share/classify
[###### ] 20% Collecting informationError: Failed to push data to the cloud: ‘NoneType’ object has no attribute ‘session’

Setup info:
dvc —version
0.19.12

macOS Mojave v10.14, dvc installed using pip

The text was updated successfully, but these errors were encountered:

Could you please run dvc push -v (notice the -v flag, that increases log verbosity) and show us the output? Also, could you show us your .dvc/config?

cat .dvc/config
[core]
cloud = AWS
[AWS]
StoragePath = dvc-share/classify

Thank you! Looks like you don’t have boto3 installed, and it wasn’t detected by dvc beforehand for some reason(looking into it right now). Could you please try running pip install —upgrade dvc[s3] and try running dvc push again?

I was able to reproduce it. Running pip install —upgrade dvc[s3] or pip install boto3 does the trick and everything starts to work fine. The bug is in that dvc doesn’t detect that boto3 is missing and doesn’t report it ahead of time when using a legacy config format that is used in the tutorial. With newer config, dvc does indeed detect the absence of boto3 and gives hint about it:

Preparing a patch to for that right now.

Btw the most recent and up to date docs/tutorials are available at https://dvc.org/documentation , please feel free to try it out as well 🙂

Thank you so much for the feedback!

Thank you — that seems to have worked as far at the boto-3 error is concerned. Now it fails with an access denied error msg.

Error: Failed to upload — An error occurred (AccessDenied) when calling the CreateMultipartUpload operation: Access Denied

Is that because I’m using an out of date tutorial?

Источник

Why am I getting an Access Denied error message when I upload files to my Amazon S3 bucket that has AWS KMS default encryption?

My Amazon Simple Storage Service (Amazon S3) bucket has AWS Key Management Service (AWS KMS) default encryption. I’m trying to upload files to the bucket, but Amazon S3 returns an Access Denied error message. How can I fix this?

Resolution

• Your AWS Identity and Access Management (IAM) user or role has s3:PutObject permission on the bucket.
• Your AWS KMS key doesn’t have an «aws/s3» alias. This alias can’t be used for default bucket encryption if cross-account IAM principals are uploading the objects. For more information about AWS KMS keys and policy management, see Protecting data using server-side encryption with AWS Key Management Service (SSE-KMS).

Then, update the AWS KMS permissions of your IAM user or role based on the error message that you receive.

Important:

• If the AWS KMS key and IAM role belong to different AWS accounts, then the IAM policy and KMS key policy must be updated. Make sure to add the KMS permissions to both the IAM policy and KMS key policy.
• To use an IAM policy to control access to a KMS key, the key policy for the KMS key must give the account permission to use IAM policies.

«An error occurred (AccessDenied) when calling the PutObject operation: Access Denied»

This error message indicates that your IAM user or role needs permission for the kms:GenerateDataKey action.

Follow these steps to add permission for kms:GenerateDataKey:

2. Choose the IAM user or role that you’re using to upload files to the Amazon S3 bucket.

3. In the Permissions tab, expand each policy to view its JSON policy document.

4. In the JSON policy documents, look for policies related to AWS KMS access. Review statements with «Effect»: «Allow» to check if the user or role has permissions for the kms:GenerateDataKey action on the bucket’s AWS KMS key.

5. If this permission is missing, then add the permission to the appropriate policy. For instructions, see Adding permissions to a user (console) or Modifying a role permissions policy (console).

6. In the JSON policy documents, look for statements with «Effect»: «Deny». Confirm that those statements don’t deny the s3:PutObject action on the bucket. The statements must not deny the IAM user or role access to the kms:GenerateDataKey action on the key used to encrypt the bucket. Also, the required KMS and S3 permissions must not be restricted when using VPC endpoint policies, service control policies, permissions boundaries, or session policies.

«An error occurred (AccessDenied) when calling the CreateMultipartUpload operation: Access Denied»

This error message indicates that your IAM user or role needs permission for the kms:GenerateDataKey and kms:Decrypt actions.

Follow these steps to add permissions for kms:GenerateDataKey and kms:Decrypt:

2. Choose the IAM user or role that you’re using to upload files to the Amazon S3 bucket.

3. In the Permissions tab, expand each policy to view its JSON policy document.

4. In the JSON policy documents, look for policies related to AWS KMS access. Review statements with «Effect»: «Allow» to check if the role has permissions for kms:GenerateDataKey and kms:Decrypt on the bucket’s AWS KMS key.

5. If these permissions are missing, then add the permissions to the appropriate policy. For instructions, see Adding permissions to a user (console) or Modifying a role permissions policy (console).

6. In the JSON policy documents, look for statements with «Effect»: «Deny». Then, confirm that those statements don’t deny the s3:PutObject action on the bucket. The statements must not deny the IAM user or role access to the kms:GenerateDataKey and kms:Decrypt actions on the key used to encrypt the bucket. Also, the required KMS and S3 permissions must not be restricted when using VPC endpoint policies, service control policies, permissions boundaries, or session policies.

Источник

DVC tutorial — error pushing data to the cloud #1231

In section 4.1, «Pushing data to the cloud», I am running into the following error:
dvc push
Warning: Using obsoleted config format. Consider updating.
Preparing to push data to s3://dvc-share/classify
[###### ] 20% Collecting informationError: Failed to push data to the cloud: ‘NoneType’ object has no attribute ‘session’

Setup info:
dvc —version
0.19.12

macOS Mojave v10.14, dvc installed using pip

The text was updated successfully, but these errors were encountered:

Could you please run dvc push -v (notice the -v flag, that increases log verbosity) and show us the output? Also, could you show us your .dvc/config?

cat .dvc/config
[core]
cloud = AWS
[AWS]
StoragePath = dvc-share/classify

Thank you! Looks like you don’t have boto3 installed, and it wasn’t detected by dvc beforehand for some reason(looking into it right now). Could you please try running pip install —upgrade dvc[s3] and try running dvc push again?

I was able to reproduce it. Running pip install —upgrade dvc[s3] or pip install boto3 does the trick and everything starts to work fine. The bug is in that dvc doesn’t detect that boto3 is missing and doesn’t report it ahead of time when using a legacy config format that is used in the tutorial. With newer config, dvc does indeed detect the absence of boto3 and gives hint about it:

Preparing a patch to for that right now.

Btw the most recent and up to date docs/tutorials are available at https://dvc.org/documentation , please feel free to try it out as well 🙂

Thank you so much for the feedback!

Thank you — that seems to have worked as far at the boto-3 error is concerned. Now it fails with an access denied error msg.

Error: Failed to upload — An error occurred (AccessDenied) when calling the CreateMultipartUpload operation: Access Denied

Is that because I’m using an out of date tutorial?

Источник

Отказано в доступе при вызове операции PutObject с разрешением на уровне корзины

Затем я протестировал конфигурацию с помощью плагина W3 Total Cache WordPress. Тест не удался.

Я также попытался воспроизвести проблему, используя

и это не удалось с

Почему я не могу загрузить в корзину?

Чтобы ответить на мой собственный вопрос:

Политика примера предоставила доступ PutObject, но мне также пришлось предоставить доступ PutObjectAcl.

Мне пришлось изменить

Вам также необходимо убедиться, что ваша корзина настроена для того, чтобы клиенты устанавливали общедоступный ACL, сняв отметки с этих двух полей:

У меня была аналогичная проблема. Я не использовал ACL, поэтому мне это не понадобилось s3:PutObjectAcl .

В моем случае я делал (в Serverless Framework YML):

Что добавляет /* в конец корзины ARN.

Надеюсь это поможет.

Я просто бился головой о стену, просто пытаясь заставить загрузку S3 работать с большими файлами. Изначально моя ошибка была:

Затем я попытался скопировать файл меньшего размера и получил:

Я мог нормально перечислять объекты, но больше ничего не мог делать, хотя у меня были s3:* разрешения в моей политике ролей. В итоге я переработал политику так:

Теперь я могу загрузить любой файл. Замените my-bucket своим именем корзины. Я надеюсь, что это поможет кому-то еще, кто переживает это.

Если это поможет кому-то еще, в моем случае я использовал CMK (он отлично работал с ключом aws / s3 по умолчанию)

Мне пришлось войти в свое определение ключа шифрования в IAM и добавить программного пользователя, вошедшего в boto3, в список пользователей, которые «могут использовать этот ключ для шифрования и дешифрования данных из приложений и при использовании сервисов AWS, интегрированных с KMS».

У меня была аналогичная проблема с загрузкой в ​​корзину S3, защищенную шифрованием KWS. У меня есть минимальная политика, которая позволяет добавлять объекты под определенным ключом s3.

Мне нужно было добавить следующие разрешения KMS в мою политику, чтобы позволить роли помещать объекты в корзину. (Может быть немного больше, чем требуется)

У меня было такое же сообщение об ошибке, которое я сделал: убедитесь, что вы используете правильный s3 uri, например: s3://my-bucket-name/

(Если my-bucket-name явно находится в корне вашего aws s3)

Я настаиваю на этом, потому что при копировании и вставке корзины s3 из вашего браузера вы получаете что-то вроде https://s3.console.aws.amazon.com/s3/buckets/my-bucket-name/?region=my-aws-regiontab=overview

Таким образом, я совершил ошибку, использовав s3://buckets/my-bucket-name какие рейзы:

An error occurred (AccessDenied) when calling the PutObject operation: Access Denied

Источник

Resolution

First, confirm:

• Your AWS Identity and Access Management (IAM) user or role has s3:PutObject permission on the bucket.
• Your AWS KMS key doesn’t have an «aws/s3» alias. This alias can’t be used for default bucket encryption if cross-account IAM principals are uploading the objects. For more information about AWS KMS keys and policy management, see Protecting data using server-side encryption with AWS Key Management Service (SSE-KMS).

Then, update the AWS KMS permissions of your IAM user or role based on the error message that you receive.

Important:

• If the AWS KMS key and IAM role belong to different AWS accounts, then the IAM policy and KMS key policy must be updated. Make sure to add the KMS permissions to both the IAM policy and KMS key policy.
• To use an IAM policy to control access to a KMS key, the key policy for the KMS key must give the account permission to use IAM policies.

«An error occurred (AccessDenied) when calling the PutObject operation: Access Denied»

This error message indicates that your IAM user or role needs permission for the kms:GenerateDataKey action.

Follow these steps to add permission for kms:GenerateDataKey:

1.    Open the IAM console.

2.    Choose the IAM user or role that you’re using to upload files to the Amazon S3 bucket.

3.    In the Permissions tab, expand each policy to view its JSON policy document.

4.    In the JSON policy documents, look for policies related to AWS KMS access. Review statements with «Effect»: «Allow» to check if the user or role has permissions for the kms:GenerateDataKey action on the bucket’s AWS KMS key.

5.    If this permission is missing, then add the permission to the appropriate policy. For instructions, see Adding permissions to a user (console) or Modifying a role permissions policy (console).

6.    In the JSON policy documents, look for statements with «Effect»: «Deny». Confirm that those statements don’t deny the s3:PutObject action on the bucket. The statements must not deny the IAM user or role access to the kms:GenerateDataKey action on the key used to encrypt the bucket. Also, the required KMS and S3 permissions must not be restricted when using VPC endpoint policies, service control policies, permissions boundaries, or session policies.

«An error occurred (AccessDenied) when calling the CreateMultipartUpload operation: Access Denied»

This error message indicates that your IAM user or role needs permission for the kms:GenerateDataKey and kms:Decrypt actions.

Follow these steps to add permissions for kms:GenerateDataKey and kms:Decrypt:

1.    Open the IAM console.

2.    Choose the IAM user or role that you’re using to upload files to the Amazon S3 bucket.

3.    In the Permissions tab, expand each policy to view its JSON policy document.

4.    In the JSON policy documents, look for policies related to AWS KMS access. Review statements with «Effect»: «Allow» to check if the role has permissions for kms:GenerateDataKey and kms:Decrypt on the bucket’s AWS KMS key.

5.    If these permissions are missing, then add the permissions to the appropriate policy. For instructions, see Adding permissions to a user (console) or Modifying a role permissions policy (console).

6.    In the JSON policy documents, look for statements with «Effect»: «Deny». Then, confirm that those statements don’t deny the s3:PutObject action on the bucket. The statements must not deny the IAM user or role access to the kms:GenerateDataKey and kms:Decrypt actions on the key used to encrypt the bucket. Also, the required KMS and S3 permissions must not be restricted when using VPC endpoint policies, service control policies, permissions boundaries, or session policies.

Related information

Setting default server-side encryption behavior for Amazon S3 buckets

UPDATE: everything works fine the next day!?! So I think the answer might be that you have to wait some period of time, either after creating a new IAM user, or after creating a new bucket, before uploads will work.

I created a dedicated IAM user, then did aws configure, and gave the key, and specified the «eu-west-1» region. I can see the correct information in ~/.aws/config.

I tried aws s3 mb s3://backup but got told it already existed. aws s3 ls confirmed it did not. However aws s3 mb s3://backup-specialtest did work.

But when I try aws s3 cp test.tgz s3://backup-specialtest I get:

A client error (AccessDenied) occurred when calling the CreateMultipartUpload operation: Anonymous users cannot initiate multipart uploads.  Please authenticate.

It is not just big files that are the problem. I made a 6-byte text file, and tried to upload with aws s3 cp test.txt s3://backup-specialtest/ but get:

upload failed: ./test.txt to s3://backup-specialtest/test.txt A client error (AccessDenied) occurred when calling the PutObject operation: Access Denied

Trying aws s3 ls s3://backup-specialtest gives me:

A client error (AccessDenied) occurred when calling the ListObjects operation: Access Denied

Trying aws s3api get-bucket-acl --bucket backup-specialtest gives me:

A client error (AccessDenied) occurred when calling the GetBucketAcl operation: Access Denied

I had already attached the «AmazonS3FullAccess» policy to my user, in the AWS web console. When I click show policy I get:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": "s3:*",
      "Resource": "*"
    }
  ]
}

That looks good: he can do all S3 actions, on all resources.

While writing this I thought I’d double-check I could still create a new bucket, and hadn’t broken anything along the way. So I tried aws s3 mb s3://another-test and got:

make_bucket failed: s3://another-test/ A client error (BucketAlreadyExists) occurred when calling the CreateBucket operation: The requested bucket name is not available. The bucket namespace is shared by all users of the system. Please select a different name and try again.

But when I try: aws s3 mb s3://another-test-2 I get success:

make_bucket: s3://another-test-2/

And it is there: aws s3 ls

2015-11-13 11:07:10 another-test-2
2015-11-13 10:18:53 backup-specialtest
2014-08-05 21:00:33 something-older

(That last bucket appears to have been created by the root user, last year, and is empty.)