What permissions are required?

[jezhalford]

Hi,

Thanks for discharge! It might solve all my problems, but every time I discharge deploy I get an AccessDenied error -

  ✔ Load configuration
  ✔ Build website
  ↓ Create bucket [skipped]
    → Bucket already exists
  ✔ Configure bucket as website
  ✖ Synchronize website
    → Access Denied
AccessDenied: Access Denied
    at Request.extractError (/Users/jezhalford/dev/my-website/node_modules/aws-sdk/lib/services/s3.js:585:35)
    at Request.<anonymous> (/Users/jezhalford/dev/my-website/node_modules/@static/discharge/lib/aws.js:91:33)
    at Request.callListeners (/Users/jezhalford/dev/my-website/node_modules/aws-sdk/lib/sequential_executor.js:106:20)
    at Request.emit (/Users/jezhalford/dev/my-website/node_modules/aws-sdk/lib/sequential_executor.js:78:10)
    at Request.emit (/Users/jezhalford/dev/my-website/node_modules/aws-sdk/lib/request.js:683:14)
    at Request.transition (/Users/jezhalford/dev/my-website/node_modules/aws-sdk/lib/request.js:22:10)
    at AcceptorStateMachine.runTo (/Users/jezhalford/dev/my-website/node_modules/aws-sdk/lib/state_machine.js:14:12)
    at /Users/jezhalford/dev/my-website/node_modules/aws-sdk/lib/state_machine.js:26:10
    at Request.<anonymous> (/Users/jezhalford/dev/my-website/node_modules/aws-sdk/lib/request.js:38:9)
    at Request.<anonymous> (/Users/jezhalford/dev/my-website/node_modules/aws-sdk/lib/request.js:685:12)
npm ERR! code ELIFECYCLE

My user seems to have all the relevant permissions -

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "VisualEditor0",
            "Effect": "Allow",
            "Action": [
                "s3:ListAllMyBuckets",
                "s3:*"
            ],
            "Resource": "*"
        },
        {
            "Sid": "VisualEditor1",
            "Effect": "Allow",
            "Action": "s3:*",
            "Resource": [
                "arn:aws:s3:::my-bucket-name/*",
                "arn:aws:s3:::my-bucket-name"
            ]
        }
    ]
}

...are there any other permissions needed?

Thank you!

[brandonweiss]

Hey! Sorry it took so long to get back to you!

Hmm. Well… the short answer is I don’t know 🙃 The entire reason I built Discharge in the first place is because AWS is super confusing, especially their permission system. I’ve frequently struggled to map what actions I’m taking with the AWS SDK onto what permissions are necessary in order for those actions to work.

Here are the possible actions Discharge takes:

S3

• putBucketWebsite
• headBucket
• createBucket
• listObjectsV2
• putObject
• deleteObject

ACM

• listCertificates
• requestCertificate
• describeCertificate

CloudFront

• getInvalidation
• listDistributions
• createInvalidation
• createDistribution
• getDistribution

---

Let me know if you’re able to figure out what permissions those actions map to!