Question
DigitalOcean Spaces put-bucket-policy no effect
- Posted on January 7, 2025
- DigitalOcean Spaces
Asked by ASTATEC
I’m trying to set a folder in a bucket as public via aws s3api cli. aws configured with access key and secret for All Permissions.
//policy.json
{
"Version": "2012-10-17",
"Statement": [
{
"Sid": "Public Images",
"Effect": "Allow",
"Principal": "*",
"Action": [
"s3:GetObject"
],
"Resource": [
"arn:aws:s3:::my-bucket/uploads/images/*"
]
}
]
}
aws s3api put-bucket-policy --policy file://./policy.json --endpoint=https://my-bucket.sfo3.digitaloceanspaces.com --bucket my-bucket
The command runs without error. Also, I get a my-bucket file at the root of the bucket with the same contents as the policy.json file. But I still get Access Denied when trying to acces files in https://my-bucket.sfo3.digitaloceanspaces.com/uploads/images/
Am I missing something?
Thank you Mat
This textbox defaults to using Markdown to format your answer.
You can type !ref in this text area to quickly search our full set of tutorials, documentation & marketplace offerings and insert the link!
These answers are provided by our Community. If you find them useful, show some love by clicking the heart. If you run into issues leave a comment, or add your own answer to help others.
Become a contributor for community
Get paid to write technical tutorials and select a tech-focused charity to receive a matching donation.
DigitalOcean Documentation
Full documentation for every DigitalOcean product.
Resources for startups and SMBs
The Wave has everything you need to know about building a business, from raising funding to marketing your product.
The developer cloud
Scale up as you grow — whether you're running one virtual machine or ten thousand.
Get started for free
Sign up and get $200 in credit for your first 60 days with DigitalOcean.*
*This promotional offer applies to new accounts only.
Hey Mat!
I believe that the
--endpointyou’re using (https://my-bucket.sfo3.digitaloceanspaces.com) points to the bucket itself. For bucket policies, you need to use the Spaces API endpoint instead:So, your command should be:
Let me know if this works!
- Bobby
Heya, @astatec
As Bobby mentioned, you seem to be including the bucket’s endpoint in the
--endpointparameter. For DigitalOcean Spaces, the--endpointshould target the regional endpoint, not the bucket’s endpoint. Forsfo3, use:You can test accessing the URL of a file, such as:
If it still shows
Access Denied, check the policy and ACL settings again.Regards
I ended up deleting the bucket a creating a new one and now it’s working. I think the problem came because first I had setup a Read/Write/Delete access key for that specific bucket and apparently they are not compatible with ACL policies.
Thank you for you support