Latest AWS CLI does not see S3 Express One Zone buckets

Question

I installed the latest AWS CLI. The output of `aws --version`:
```none
aws-cli/2.14.5 Python/3.11.6 Linux/5.10.16.3-microsoft-standard-WSL2 exe/x86_64.ubuntu.22 prompt/off
```

After configuring, `aws s3 ls` lists my regular S3 buckets, but does not list the newly created S3 Express One Zone bucket. Specifying `--region us-east-1` explicitly does not help.

I added the following inline policy to the user:
```none
{
	"Version": "2012-10-17",
	"Statement": [
		{
			"Effect": "Allow",
			"Action": [
				"s3express:*"
			],
			"Resource": "*"
		}
	]
}
```

What else could I be missing?

P.S. Not sure if related, but in the Console, the "Find objects by prefix" box is grayed out for my S3 Express One Zone buckets.

Minux · Accepted Answer

I tested with AWS CLI (aws-cli/2.14.6 Python/3.11.6 Darwin/22.6.0 exe/x86_64 prompt/off) and could observe same symptom as you mentioned. I think there would be a room for improvement for better customer experience.

```
For a directory bucket,

aws s3api list-objects-v2 --bucket bucketname (Working)
aws s3api list-directory-buckets (Working)

aws s3 ls (Directory bucket was not displayed.)
aws s3 ls bucketname (Working)
```

Rocket · Answer

You would need to specify bucket/${BucketName} in arn of your policy.

eg:-

```
{
	"Version": "2012-10-17",
	"Statement": [
		{
			"Effect": "Allow",
			"Action": [
				"s3express:*"
			],
			"Resource": "arn:${Partition}:s3express:${Region}:${Account}:bucket/${BucketName}"
		}
	]
}
```

or you can also use - arn:${Partition}:s3express:${Region}:${Account}:bucket/*

Latest AWS CLI does not see S3 Express One Zone buckets

Relevant content