S3 batch operation CreateJob access denied

Question

I'm trying to create batch jobs on S3. My API calls work fine when I have full S3 admin access, but now I'm trying to restrict access.

I granted S3::CreateJob on the bucket where the job is to be created, and iam::PassRole for the role for the job to run as, but CreateJob always fails with access denied. However, it works if I grant CreateJob on resource "*" rather than the specific bucket.

Is this expected? This old post https://repost.aws/questions/QUJGUe8pZ8SWKsqFCqGrvOFg/what-iam-permissions-are-needed-to-do-a-createjob-for-s3-batch#ANHD8M2jXfRtycUPZ4S5r-vQ suggests it is.

Accepted Answer

Hello.  
When using CreateJob, the resource section must be set to "*".  
As you can see from the following documentation, there is nothing listed in the CreateJob resource column that can be restricted.  
https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazons3.html#amazons3-actions-as-permissions

S3 batch operation CreateJob access denied

Relevanter Inhalt