What permissions does django-storages require for an s3 IAM user?

Fiver's answer is not enough to run collectstatic in django-storages. I used everything @jvc26 did except for s3:ListAllMyBuckets. I would assume s3:ListBucketVersions is not needed either.

{
  "Statement": [
    {
      "Effect": "Allow",
      "Action": ["s3:ListBucket",
                 "s3:GetBucketLocation",
                 "s3:ListBucketMultipartUploads",
                 "s3:ListBucketVersions"],
      "Resource": "arn:aws:s3:::bucket-name"
    },
    {
      "Effect": "Allow",
      "Action": ["s3:*Object*",
                 "s3:ListMultipartUploadParts",
                 "s3:AbortMultipartUpload"],
      "Resource": "arn:aws:s3:::bucket-name/*"
    }
  ]
}

Refer to official Django Storages official documentation here: https://django-storages.readthedocs.io/en/latest/backends/amazon-S3.html#iam-policy

You can simply copy and paste that permission into you IAM policy.

I'm not 100% sure about django-storages, as I use cuddly-buddly which is based on the S3 portion of django-storages. I just found cuddlybuddly simpler to use and worked better, plus the name is awesome!

Anyway, I have a project using Django+S3 and found the following AWS policy as the minimum required for my project:

{
  "Version": "2008-10-17",
  "Id": "Policy123",
  "Statement": [
    {
      "Sid": "Stmt123",
      "Effect": "Allow",
      "Principal": {
        "AWS": "arn:aws:iam::some-aws-user"
      },
      "Action": "s3:ListBucket",
      "Resource": "arn:aws:s3:::bucket-name"
    },
    {
      "Sid": "Stmt234",
      "Effect": "Allow",
      "Principal": {
        "AWS": "arn:aws:iam::some-aws-user"
      },
      "Action": [
        "s3:DeleteObject",
        "s3:GetObject",
        "s3:PutObject"
      ],
      "Resource": "arn:aws:s3:::bucket-name/*"
    }
  ]
}

I have Django views that need to upload, retrieve, and delete so those corresponding actions can be used/omitted based on your needs. Obviously, anyone will need to change the user and bucket name.

Also, just for completeness as it wasn't obvious to me, note the following restrictions regarding AWS policies:

• The maximum size of a policy is 20 KB

• The value for Resource must be prefixed with the bucket name or the bucket name and a path under it (bucket/). If only the bucket name is specified, without the trailing /, the policy applies to the bucket.

• Each policy must have a unique policy ID (Id)

• Each statement in a policy must have a unique statement ID (sid)

• Each policy must cover only a single bucket and resources within that bucket (when writing a policy, don't include statements that refer to other buckets or resources in other buckets)

Finally, to anyone tempted to do so, don't change the date value in the Version key, Amazon uses this value to parse the policy format.

Hope this helps!