Troubleshooting MinIO policies

The python script I was working with was trying to store an object in a MinIO bucket.

 minio_client.put_object(...)

It all worked fine when using the minio root account. However, it started failing as soon as I began using a MinIO account only allowed to PUT objects into the bucket.

S3 operation failed; code: AccessDenied, message: Access Denied.

It worked fine from mc, the MinIO Client. 

It worked fine if I manually modified the policy to allow all S3 actions.

                "Action": [

                  "s3:*",

                ],

It worked fine even after reverting back to the original policy of only PutObject. If I just had had the wildcard at some point after starting the script.

                "Action": [

                  "s3:PutObject"

                ],

The key to troubleshooting this was to run a trace on the minio

# mc alias set myminio http://... minioadmin miniopassword

# mc admin trace myminio

There, I could spot what was failing:

[403 Forbidden] s3.GetBucketLocation

Apparently, the MinIO python library needs to issue this other request in addition to the actual PutObject. But possibly caching the result, as subsequent attempts won't fail even if it's not permitted.

The policy that finally worked, had to include both actions:

          {

            "Version": "2012-10-17",

            "Statement": [

            {

              "Principal": "*",

              "Effect": "Allow",

                "Action": [

                  "s3:GetBucketLocation",

                  "s3:PutObject"

                ],

                "Resource": [

                  "arn:aws:s3:::xyz",

                  "arn:aws:s3:::xyz/*"

                ]

              }

            ]

          }