Document minimum AMI user permissions/ACLs in order for accesssing an AWS bucket about s3-plugin-webpack

[patcon]

Ok, after some experimentation, found the minimal permissions for bucket and plugin setup is:

{
  s3Options: {
    // ...
  },
  s3UploadOptions: {
    ACL: '',
    Bucket: 'YOURBUCKET'
  }
}

IAM > Users > YOURUSER > Permissions > Add inline policy (JSON):

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "s3:PutObject"
            ],
            "Resource": "arn:aws:s3:::YOURBUCKET/*"
        }
    ]
}

S3 > YOURBUCKET > Permissions > Block public access: All "OFF"

S3 > YOURBUCKET > Permissions > Bucket Policy:

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "AllowPublicRead",
            "Effect": "Allow",
            "Principal": {
                "AWS": "*"
            },
            "Action": "s3:GetObject",
            "Resource": "arn:aws:s3:::YOURBUCKET/*"
        }
    ]
}

[SunSparc]

It would be nice to see documented exactly which actions are required for this plugin to work. I do not like giving more privileges than necessary. I use the following policy for other services and it works. But with s3-plugin-webpack I get Access Denied. So what else is this plugin trying to do?

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": "s3:PutObject",
            "Resource": "arn:aws:s3:::mybucket/*"
        }
    ]
}

Another policy example is in issue #62.

[patcon]

This is really helpful @SunSparc :) I'll try to upstream a doc change when I'm next using this plugin

[SunSparc]

Well, after going through all the permissions myself it turns out that s3-plugin-webpack also needs the PutObjectAcl by default, unless ACL: "", is added to the s3UploadOptions, which was mentioned on #28.

[mapineda]

@patcon Does

{
  s3Options: {
    // ...
  },
  s3UploadOptions: {
    ACL: '',
    Bucket: 'YOURBUCKET'
  }
}

"YOURBUCKET" have to be a hardcoded string? Having a difficult time passing this value from an .env using process.env or even using an environment.js file that takes the .env vars and exports them to webpack.

[patcon]

I don't think so, @mapineda :(