AWS Permissions

[fran-worley]

This is more of an FYI incase anyone else experiences this, but it might be an idea to at least update the readme to explain that in addition to the permissions required by ember-cli-deploy-s3 this addon also requires listObject and listBucket.

If you don't add these you'll get this slightly cryptic error:

TypeError: Cannot read property 'length' of undefined
TypeError: Cannot read property 'length' of undefined
    at listObjects.then.then.catch.then (/Users/Projects/ember-app/node_modules/ember-cli-deploy-fastboot-app-server-aws/index.js:40:28)
    at tryCatch (/Users/Projects/ember-app/node_modules/rsvp/dist/rsvp.js:525:12)
    at invokeCallback (/Users/Projects/ember-app/node_modules/rsvp/dist/rsvp.js:538:13)
    at publish (/Users/Projects/ember-app/node_modules/rsvp/dist/rsvp.js:508:7)
    at flush (/Users/Projects/ember-app/node_modules/rsvp/dist/rsvp.js:2415:5)
    at process._tickCallback (internal/process/next_tick.js:150:11)

I guess in an ideal world this error could be caught and a more helpful error reported?

[LevelbossMike]

Thanks for reporting this @fran-worley! Fixed via 8bcc0ae

[pauldailly]

Hey @LevelbossMike @fran-worley I'm also running into the issue described here. I can't seem to resolve it with the instructions provided however, although it may be that I am just misunderstanding them. I have an S3 bucket policy which looks like:

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "PublicReadGetObject",
            "Effect": "Allow",
            "Principal": "*",
            "Action": [
                "s3:GetObject",
                "s3:ListBucket"
            ],
            "Resource": [
                "arn:aws:s3:::com.bucket.name/*",
                "arn:aws:s3:::com.bucket.name"
            ]
        }
    ]
}

I also have the following List objects permission given to the Everyone group in the bucket's ACL section as shown below:

Can you see anything I'm doing wrong which would cause this not to work?

Any help you can provide would be much appreciated.

[LevelbossMike]

Hi @pauldailly!

https://github.com/ember-cli-deploy/ember-cli-deploy-s3/blob/master/README.md#deployment-user-and-s3-permissions

You seem to be missing the permissions that the s3 plugin expects, e.g. Putobject

[pauldailly]

Hi @LevelbossMike thanks for getting back to me! I thought the permissions section you linked to in your reply above was in regards to permissions required by the IAM user doing the deploy, rather than the S3 Bucket policy permissions?

I have been able to deploy to S3 using the s3 plugin successfully prior to adding the fastboot deploy plugin. My IAM user has an admin role (i.e it has full permissions for my AWS account).

Can I just confirm that in your original reply on this issue, when you said you needed the listObject permission, you were referring to the List objects permission given to the Everyone group in the bucket's ACL section? Or is that an IAM user permission?

[LevelbossMike]

@pauldailly I'm usually creating a user specific for the deploys and these users need to have the permissions for the s3-plugin and in addition the ones mentioned in this issue - it seems like based on what the original author of this issue said. I tend to give the created user full s3 permission on the specific bucket(s) I'm using for deployments though. So I'm not really familiar with the ins and outs of s3 permissions unfortunately.

[pauldailly]

Hey @LevelbossMike I created a new IAM user with specific S3 permissions only and now it works! I'm not sure why my original 'admin access' IAM user failed to work, but I will investigate that for myself.

Thanks very much for your help!