Creating a S3 asset source shouldn't require the "ListAllMyBuckets" IAM policy

[angrybrad]

Created by: Ben Smith (ben@vectormediagroup.com) on 2016/06/02 21:23:04 +0000
Votes at time of UserVoice import: 8

---

To choose a bucket, you provide key/secret, and a dropdown is populated. This requires the IAM User behind the key/secret to have the "ListAllMyBuckets" IAM policy.

If bucket name field was a textbox, this permission would not be required. This is a nice feature, but is unnecessary and does not follow the principle of least privilege.

[angrybrad]

Posted by Larry Dennison (larry@barrelstrengthdesign.com) on 2015/05/15 23:08:15 +0000

---

I completely agree with this. Craft should likely implement some kind of switch that allows the user to specify the direct name of the bucket instead of being required to choose from the dropdown. That solves both use cases (admins that don't care about seeing all buckets, and admins that follow the principle of least privilege.

For agencies that use S3 to provide centralization of asset storage, this is a dealbreaker since it publicizes the bucket names.