Allow S3 access to AWS Serverless Repo in IAM Policy

Question

My IAM user that is responsible for deploying CDK templates has an IAM policy specified (Listing 1.), to limit which S3 buckets it has access to.

When attempting to deploy an application from AWS Serverless Repos, I receive the error in Listing 2. This error leads me to believe that the CDK deployer has tried to read some artifact out of an S3 bucket associated with deploying an application from AWS Serverless Repos.

How should I update this policy to allow my CDK deployer to access the relevant S3 bucket? I can't / don't know how to derive the relevant ARN pattern to indicate that I want to allow the CDK deployer to access the S3 buckets associated with AWS Serverless Repos.

```
...
        {
            "Sid": "MyPolicy",
            "Effect": "Allow",
            "Action": [
                "s3:GetObject",
            ],
            "Resource": [
                "arn:aws:s3:::something-here-*/*"
                "arn:aws:s3:::something-else-*/*"
            ]
        },
...
```
**Listing 1.**

```
Your access has been denied by S3, please make sure your request credentials have permission to GetObject for awsserverlessrepo-changesets-1my58927y6rqa/857181079225/arn:aws:serverlessrepo:eu-central-1:482117739457:applications-cloudwatch-alarm-to-ms-teams-versions-1.1.8/465e2e1c-1c66-417d-9528-0855feae5e55.
```
**Listing 2.**

Behrang_KS · Answer

You can refer to this documentation to modify your IAM policy for using AWS Serverless Repo : https://docs.aws.amazon.com/serverlessrepo/latest/devguide/security_iam_service-with-iam.html

lkelly · Answer

I am having this same problem, but the documentation does not offer any solutions on what to add for an access policy. Was your problem solved?

In my case, the error is coming from a cloudformation stack that is deploying the serverless repo. If I update the execution role of the stack to include s3:Get* on Resource: "*" then it works. I need to know how to scope this down

AndersB · Answer

The bucket name in your case is `awsserverlessrepo-changesets-1my58927y6rqa`

Allow S3 access to AWS Serverless Repo in IAM Policy

Relevant content