# AWS IAM Policy for S3 Output Plugin

**URL:** <https://discuss.elastic.co/t/aws-iam-policy-for-s3-output-plugin/204790>\
**Category:** Logstash\
**Created:** [October 23, 2019, 6:49am UTC](https://discuss.elastic.co/t/aws-iam-policy-for-s3-output-plugin/204790 "2019-10-23T06:49:20Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![cytim](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/cytim/32/56378_2.png) [@cytim](https://discuss.elastic.co/u/cytim)\
**Post date:** [October 23, 2019, 6:49am UTC](https://discuss.elastic.co/t/aws-iam-policy-for-s3-output-plugin/204790/1 "2019-10-23T06:49:20Z")

</div>

Extending the [S3 output requires PutObject on \* Resources](https://discuss.elastic.co/t/s3-output-requires-putobject-on-resources/103457), this post is created for other people to setup the IAM policy for S3 output plugin.

```
{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "LogstashPutObject",
            "Effect": "Allow",
            "Action": "s3:PutObject",
            "Resource": "arn:aws:s3:::mybucket/*"
        },
        {
            "Sid": "LogstashDeleteTestObject",
            "Effect": "Allow",
            "Action": "s3:DeleteObject",
            "Resource": "arn:aws:s3:::mybucket/logstash-programmatic-access-test-object-*"
        }
    ]
}

```

The plugin simply requires the **PutObject** permission on the _whole_ bucket to work. However, this will [leave a "programmatic access test objects" on the bucket](https://github.com/logstash-plugins/logstash-output-s3/issues/97) every time Logstash starts. Including the **DeleteObject** permission will solve the issue.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [November 20, 2019, 6:49am UTC](https://discuss.elastic.co/t/aws-iam-policy-for-s3-output-plugin/204790/2 "2019-11-20T06:49:21Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.