s3 location for AWS policy throws AccessDenied

[johnturnerTCC]

After installing iamctl, running with init fails with AccessDenied on the AWS policy download from s3. The file https://awspolicygen.s3.amazonaws.com/js/policies.js mentioned in README.rst is available via browser.

host:src $ iamctl init
 ____    __    __  __  ___  ____  __
(_  _)  /__\  (  \/  )/ __)(_  _)(  )
 _)(_  /(__)\  )    (( (__   )(   )(__
(____)(__)(__)(_/\/\_)\___) (__) (____)

Initializing
Downloading IAM file from awspolicygen S3 Bucket: iam.json
Traceback (most recent call last):
  File "/usr/local/bin/iamctl", line 24, in <module>
    sys.exit(main())
  File "/usr/local/bin/iamctl", line 20, in main
    return iamctl.iamctl.main()
  File "/usr/local/lib/python3.7/site-packages/iamctl/iamctl.py", line 153, in main
    globals()[kwargs.pop('subparser')](**kwargs)
  File "/usr/local/lib/python3.7/site-packages/iamctl/iamctl.py", line 87, in init
    response = s3.get_object(Bucket="awspolicygen", Key="js/policies.js")
  File "/usr/local/lib/python3.7/site-packages/botocore/client.py", line 357, in _api_call
    return self._make_api_call(operation_name, kwargs)
  File "/usr/local/lib/python3.7/site-packages/botocore/client.py", line 661, in _make_api_call
    raise error_class(parsed_response, operation_name)
botocore.exceptions.ClientError: An error occurred (AccessDenied) when calling the GetObject operation: Access Denied

[xparticle]

iamctl currently gets the js/policies.js object using sdk, so the assumed role/ user that you are running the tool with would need to have s3:GetObject permission on the awspolicygen bucket. apologize for the hiccup!, I will call this out in the prerequisites section. Please confirm that this solves your issue.

[johnturnerTCC]

OK, should it be noted somewhere that an AWS user or role has to be updated with s3:GetObject on that bucket before running iamctl init? And perhaps provide the s3 object ARN so the requestor's IAM policy is updated correctly? Even so, that seems like a pretty specific requirement when the file is available to the general public without any credentials whatsoever here. Would it be simpler to just get the file that way in iamctl.py?

[kishan1988-hub]

AWS user or role has to be updated with s3:GetObject

Did it solve the problem, I have created a new policy for access to this S3 bucket awspolicygen with S3:GetObject previlege & yet same issue is being faced. Can you confirm the steps performed

[burnsie123]

For me, the issue was the named profile.

export AWS_PROFILE=[profile name]
just make sure the [profile name] is configured in .aws/config