Amazon S3 - IAM Policy | SL Migrations

Amazon S3 IAM Policy

Note: the current SL Migrations build does not include Amazon S3 or other cloud storage (those SDKs were removed from this build); only Local and FTP/SFTP are available. This article is kept for reference and does not apply to the current build.

Best practice: create an IAM user with only the minimum permissions the plugin needs, not full S3 access.

Policy JSON

Create the policy in IAM → Policies → Create policy → JSON tab:

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "ListBucket",
            "Effect": "Allow",
            "Action": [
                "s3:ListBucket",
                "s3:GetBucketLocation"
            ],
            "Resource": "arn:aws:s3:::your-bucket-name"
        },
        {
            "Sid": "ObjectOperations",
            "Effect": "Allow",
            "Action": [
                "s3:PutObject",
                "s3:GetObject",
                "s3:DeleteObject",
                "s3:GetObjectAcl",
                "s3:PutObjectAcl",
                "s3:AbortMultipartUpload",
                "s3:ListMultipartUploadParts"
            ],
            "Resource": "arn:aws:s3:::your-bucket-name/*"
        }
    ]
}

Replace your-bucket-name with your real bucket name in both Resource lines.

What each action is for

Action	Why it is needed
`s3:ListBucket`	List the archives in the bucket (to show the backup list)
`s3:GetBucketLocation`	Detect the region for multipart upload
`s3:PutObject`	Upload the archive
`s3:GetObject`	Download the archive when restoring
`s3:DeleteObject`	Delete old backups (retention policy)
`s3:GetObjectAcl` + `s3:PutObjectAcl`	Set a private ACL on the archive
`s3:AbortMultipartUpload`	Clean up if an upload fails
`s3:ListMultipartUploadParts`	Resume an upload

Attach the policy to the user

Save the policy with the name SLMigrationsS3
IAM → Users → sl-migrations-backup → Permissions → Add permissions → Attach policies directly
Tick SLMigrationsS3 → Next → Add

Anti-patterns

Do not attach AmazonS3FullAccess - it grants far more than needed
Do not use a root account access key - always create a separate IAM user
Do not commit the Access Key to git or a public repository

Restrict by IP (optional, advanced)

Add a condition to the policy so it only accepts requests from your site's server IP:

{
    "Condition": {
        "IpAddress": {
            "aws:SourceIp": "1.2.3.4/32"
        }
    }
}

If the key leaks, an attacker cannot use it from another IP. Note: the server IP must be static and must not change.

Test the policy

After attaching the policy, go to plugin → Storage → Test Connection. It must PASS for List + Put + Get + Delete operations.

Amazon S3 - IAM Policy