# S3 permissions

**URL:** <https://discuss.elastic.co/t/s3-permissions/224531>\
**Category:** Elasticsearch\
**Created:** [March 21, 2020, 7:30pm UTC](https://discuss.elastic.co/t/s3-permissions/224531 "2020-03-21T19:30:46Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![thoth](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/thoth/32/40765_2.png) [@thoth](https://discuss.elastic.co/u/thoth)\
**Post date:** [March 21, 2020, 7:30pm UTC](https://discuss.elastic.co/t/s3-permissions/224531/1 "2020-03-21T19:30:46Z")

</div>

The documentation has become outdated on the S3 permissions.

[https://www.elastic.co/guide/en/elasticsearch/plugins/current/repository-s3-repository.html#repository-s3-permissions](https://www.elastic.co/guide/en/elasticsearch/plugins/current/repository-s3-repository.html#repository-s3-permissions)

If you try to apply this policy AWS complains about missing a principal. So I tried the policy generator, but I am unable to come up with a magical combination of something that works.

The credentials were created using the keystore tool:

```auto
elasticsearch-keystore add s3.client.default.access_key
elasticsearch-keystore add s3.client.default.secret_key

```

I consistently get the following:

```auto
    {
      "error": {
    "root_cause": [
      {
        "type": "repository_verification_exception",
        "reason": "[AWSserviceaccount] path is not accessible on master node"
      }
    ],
    "type": "repository_verification_exception",
    "reason": "[AWSserviceaccount] path is not accessible on master node",
    "caused_by": {
      "type": "i_o_exception",
      "reason": "Unable to upload object [tests-xxxxxxxxxxxxxx/master.dat] using a single upload",
      "caused_by": {
        "type": "sdk_client_exception",
        "reason": "Unable to load credentials from service endpoint",
        "caused_by": {
          "type": "socket_timeout_exception",
          "reason": "Connect timed out"
        }
      }
    }
      },
      "status": 500
    }

```

Can we get an update to the docs that gives the correct method of creating the IAM user + bucket?

---

<div class="post-metadata">

**Author:** ![spinscale](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/spinscale/32/25011_2.png) [@spinscale](https://discuss.elastic.co/u/spinscale)\
**Post date:** [March 23, 2020, 11:00am UTC](https://discuss.elastic.co/t/s3-permissions/224531/2 "2020-03-23T11:00:15Z")

</div>

Hey,

can you share the error message of the missing principal? The exception you pasted looks like a network issue, as the network connection seemed to have timed out...

--Alex

---

<div class="post-metadata">

**Author:** ![thoth](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/thoth/32/40765_2.png) [@thoth](https://discuss.elastic.co/u/thoth)\
**Post date:** [March 23, 2020, 6:56pm UTC](https://discuss.elastic.co/t/s3-permissions/224531/3 "2020-03-23T18:56:11Z")

</div>

yep, when saving the given json (\*with the ARN from my bucket replaced in there) from the link above, I get:

```auto
Error

Missing required field Principal

```

So instead I generated a config like:

```auto
{
    "Version": "2012-10-17",
    "Id": "Policy888bignum888",
    "Statement": [
        {
            "Sid": "888bigsid888",
            "Effect": "Allow",
            "Principal": {
                "AWS": "arn:aws:iam::888bignum888:user/myserviceaccount"
            },
            "Action": "s3:*",
            "Resource": "arn:aws:s3:::myarn"
        }
    ]
}

```

but this is not working. Translating the changes back into the documented policy I get something like:

```auto
{
  "Statement": [
    {
      "Action": [
        "s3:ListBucket",
        "s3:GetBucketLocation",
        "s3:ListBucketMultipartUploads",
        "s3:ListBucketVersions"
      ],
      "Effect": "Allow",
      "Principal": {
          "AWS": "arn:aws:iam::876bignum876:user/myserviceaccount"
      },
      "Resource": [
        "arn:aws:s3:::snaps.example.com"
      ]
    },
    {
      "Action": [
        "s3:GetObject",
        "s3:PutObject",
        "s3:DeleteObject",
        "s3:AbortMultipartUpload",
        "s3:ListMultipartUploadParts"
      ],
      "Effect": "Allow",
      "Principal": {
          "AWS": "arn:aws:iam::876bignum876:user/myserviceaccount"
      },
      "Resource": [
        "arn:aws:s3:::snaps.example.com/*"
      ]
    }
  ],
  "Version": "2012-10-17"
}

```

but again not working as well

---

<div class="post-metadata">

**Author:** ![thoth](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/thoth/32/40765_2.png) [@thoth](https://discuss.elastic.co/u/thoth)\
**Post date:** [March 24, 2020, 1:44pm UTC](https://discuss.elastic.co/t/s3-permissions/224531/4 "2020-03-24T13:44:08Z")

</div>

@spinscale to test the network connection I executed a shell inside my elasticsearch-master-0 host with:

```auto
kubectl exec -it elasticsearch-master-0 -- /bin/bash

```

and then tried a verbose curl on the main endpoint:

```auto
curl s3.amazonaws.com -v
* About to connect() to s3.amazonaws.com port 80 (#0)
* Trying 52.216.204.205...
* Connected to s3.amazonaws.com (52.216.204.205) port 80 (#0)
> GET / HTTP/1.1
> User-Agent: curl/7.29.0
> Host: s3.amazonaws.com
> Accept: */*
> 
< HTTP/1.1 307 Temporary Redirect
< x-amz-id-2: dqTEXiH0LTQr4OyT5edurqjPbZLvdnCWHVyfA0pfX9ObfzbskQuA9Y7wY7VgESIHN95Swmlu0Yc=
< x-amz-request-id: 066D2981B33F5D86
< Date: Tue, 24 Mar 2020 13:41:28 GMT
< Location: https://aws.amazon.com/s3/
< Content-Length: 0
< Server: AmazonS3
< 
* Connection #0 to host s3.amazonaws.com left intact

```

Which seems like a good connection to me. I followed through to `curl https://aws.amazon.com/s3/ -v` and I get the same results that I do on my local laptop.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [April 21, 2020, 1:44pm UTC](https://discuss.elastic.co/t/s3-permissions/224531/5 "2020-04-21T13:44:23Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.