AWS STS Temporary Credentials S3 Access Denied PutObject

kindly answered here https://stackoverflow.com/questions/60153869/aws-sts-temporary-credentials-s3-access-denied-putobject?noredirect=1#comment106405650_60153869

There is no need to use a Bucket Policy for your scenario. A bucket policy is applied to an Amazon S3 bucket and is typically used to grant access that is specific to the bucket (eg public access).

Using an IAM Role

If you wish to provide bucket access to a specific IAM User, IAM Group or IAM Role, then the permissions should be attached to the IAM entity rather than the bucket.

(For get-session-token, see the end of my answer.)

Setup

Let's start by creating an IAM Role similar to what you had. I choose Create role, then for trusted entity I select Another AWS account (since it will be assumed by an IAM User rather than service).

I then create an Inline policy on the IAM Role to permit access to the bucket:

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": "s3:*",
            "Resource": "arn:aws:s3:::my-bucket"
        }
    ]
}

(It's normally not a good idea to assign s3:* permissions, since this lets the user delete content and even delete the bucket. Try to restrict it to the minimum permissions that are actually required.)

The Trust Relationship on the IAM Role determines who is allowed to assume the role. It could be one person, or anyone in the account (as long as they have been granted permission to call AssumeRole). In my case, I'll assign it to the whole account:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {
        "AWS": "arn:aws:iam::MY-ACCOUNT-ID:root"
      },
      "Action": "sts:AssumeRole"
    }
  ]
}

Now there are a few different ways to assume the role...

Simple method: IAM Role in credentials file

The AWS CLI has the ability to specify an IAM Role in the credentials file, and it will automatically assume the role for you.

See: Using an IAM Role in the AWS CLI https://docs.aws.amazon.com/cli/latest/userguide/cli-configure-role.html

To use this, I add a section to my .aws/config file:

[profile foo]
role_arn = arn:aws:iam::MY-ACCOUNT-ID:role/MY-ROLE-NAME
source_profile = default

I could then simply use it with:

aws s3 ls s3://my-bucket --profile foo

This successfully lets me access that specific bucket.

Complex method: Assume the role myself

Rather than letting the AWS CLI do all the work, I can also assume the role myself:

aws sts assume-role --role-arn arn:aws:iam::MY-ACCOUNT-ID:role/MY-ROLE-NAME --role-session-name foo

{
    "Credentials": {
        "AccessKeyId": "ASIA...",
        "SecretAccessKey": "...",
        "SessionToken": "...",
        "Expiration": "2020-02-11T00:43:30+00:00"
    },
    "AssumedRoleUser": {
        "AssumedRoleId": "AROA...:foo",
        "Arn": "arn:aws:sts::MY-ACCOUNT-ID:assumed-role/MY-ROLE-NAME/foo"
    }
}

I then appended this information to the .aws/credentials file:

[foo2]
aws_access_key_id = ASIA...
aws_secret_access_key = ...
aws_security_token= ...

Yes, you could add this to the credentials file by using aws configure --foo2, but it does not prompt for the Security Token. Therefore, you need to edit the credentials file to add that information anyway.

I then used the profile:

aws s3 ls s3://my-bucket --profile foo2

It allowed me to successfully access and use the bucket.

Using GetSessionToken

The above examples use an IAM Role. This is typically used to grant cross-account access or to temporarily assume more-powerful credentials (eg an Admin performing sensitive operations).

Your Question references get-session-token. This provides temporary credentials based on a user's existing credentials and permissions. Thus, they cannot gain additional permissions as part of this API call.

This call is typically used either to supply an MFA token or to provide time-limited credentials for testing purposes. For example, I could give you credentials that effectively let you use my IAM User, but only for a limited time.