IAM role for S3 encrypted upload only

Question

Hi All,   
  
I have an SFTP server that receives data files on a daily basis.   
I would like to copy these files to S3 and encrypt them for perpetual storage.   
My preference is that the IAM role granted to the SFTP server only has permissions to encrypt, not decrypt the files.   
From the documentation, I should be able to achieve this by specifying a key on upload to S3 and ensuring the IAM role for the SFTP server has only the encrypt permission.   
  
My IAM policies below:   
  
Firstly, S3 allow all (Just for testing):

```
{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": "s3:*",
            "Resource": "*"
        }
    ]
}
```

KMS Policy:

```
{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "VisualEditor0",
            "Effect": "Allow",
            "Action": "kms:Encrypt",
            "Resource": "arn:aws:kms:ap-southeast-2::key/ "
        }
    ]
}
```

When I try and copy a file to S3 using

```
aws s3 cp test.txt s3:///test.txt --sse aws:kms --sse-kms-key-id 
```

I get an error message:

```
An error occurred (AccessDenied) when calling the PutObject operation: Access Denied
```

If I manually go into the KMS policy and allow the IAM user permissions, then the IAM user can encrypt & decrypt the file which is not what I want.   
  
Has anyone managed to achieve this?

Ujjawal_S · Answer

Yes, you are correct in order for successfully uploading and downloading the SSE-KMS encrypted objects from S3 bucket you would need "kms:Encrypt" , "kms:Decrypt" and "kms:GenerateDataKey" permissions inside the IAM role.

https://repost.aws/knowledge-center/s3-large-file-encryption-kms-key

WilliamGebers · Answer

For anyone else who wants to achieve this.  I was missing a single permission "kms:GenerateDataKey".  Full policy below.

```
{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "VisualEditor0",
            "Effect": "Allow",
            "Action": [
                "kms:Encrypt",
                "kms:GenerateDataKey",
				"s3:PutObject",
                "s3:ListBucket",
                "s3:PutObjectAcl"
            ],
            "Resource": [
                "arn:aws:s3:::",
                "arn:aws:s3:::/*",
                "arn:aws:kms:::key/"
            ]
        },
        {
            "Sid": "VisualEditor1",
            "Effect": "Allow",
            "Action": "s3:HeadBucket",
            "Resource": "*"
        }
    ]
}
```

IAM role for S3 encrypted upload only

Relevant content