---
title: "Amazon S3: Required IAM Permissions"
img: https://unified.to/images/logo.svg
date: 2026-11-06T18:05:00.000Z
updated: "2026-11-06T18:13:47.207Z"
tag: Guides
integrations: awss3
description: "The IAM user whose access key you give Unified needs these S3 permissions,"
url: "https://docs.unified.to/guides/amazon_s3_required_iam_permissions"
---

# Amazon S3: Required IAM Permissions
------
_November 6, 2026_

## Required IAM permissions


The IAM user whose access key you give Unified needs these S3 permissions:


| Permission            | Needed for                                               | Required?                |
| --------------------- | -------------------------------------------------------- | ------------------------ |
| `s3:ListAllMyBuckets` | Listing your buckets (the top level of the file browser) | Yes                      |
| `s3:ListBucket`       | Listing files and folders inside a bucket                | Yes                      |
| `s3:GetObject`        | Reading and downloading files                            | Yes                      |
| `s3:PutObject`        | Uploading and updating files                             | Only if you write files  |
| `s3:DeleteObject`     | Deleting files                                           | Only if you delete files |
## Example IAM policy


Replace `your-bucket-name` with your bucket. Remove the `Write` statement for read-only access.


```json
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "ListBuckets",
      "Effect": "Allow",
      "Action": "s3:ListAllMyBuckets",
      "Resource": "*"
    },
    {
      "Sid": "ListBucketContents",
      "Effect": "Allow",
      "Action": "s3:ListBucket",
      "Resource": "arn:aws:s3:::your-bucket-name"
    },
    {
      "Sid": "Read",
      "Effect": "Allow",
      "Action": "s3:GetObject",
      "Resource": "arn:aws:s3:::your-bucket-name/*"
    },
    {
      "Sid": "Write",
      "Effect": "Allow",
      "Action": ["s3:PutObject", "s3:DeleteObject"],
      "Resource": "arn:aws:s3:::your-bucket-name/*"
    }
  ]
}
```


`s3:ListAllMyBuckets` can't be limited to a single bucket in AWS, so it needs `"Resource": "*"`.


## Common issues

- **Use a long-lived IAM user access key (starting with** **`AKIA`****).** Temporary credentials from AWS SSO or an assumed role (starting with `ASIA`) need a session token, which this connection doesn't accept.
- **Enter the region your buckets are in** (e.g. `us-east-1`). The AWS CLI fills in the region from `~/.aws/config` automatically, so credentials that work on the CLI can still fail if the region is left blank here.
- **"is not authorized to perform: s3:ListAllMyBuckets"** means the IAM user is missing that permission. Add it using the policy above.

For the full list of S3 permissions, see AWS's [Actions, resources, and condition keys for Amazon S3](https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazons3.html).