[ERROR]: Configure S3 Access by IAM Role = Contains Incorrect Policy

[colinbjohnson]

Is there an existing issue for this?

• I have searched the existing issues.

Issue

The policy given here https://milvus.io/docs/s3.md#Associate-an-IAM-role-with-a-Kubernetes-service-account is not correct - there is no reason to apply a s3:ListBucket statement to a resource named arn:aws:s3:::<bucket-name>/* - the s3:ListBucket only needs to be applied to a bucket itself. The current policy is shown below:

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "s3:GetObject",
                "s3:PutObject",
                "s3:ListBucket",
                "s3:DeleteObject"
            ],
            "Resource": [
                "arn:aws:s3:::cloudavail-milvus",
                "arn:aws:s3:::cloudavail-milvus/*"
            ]
        }
    ]
}

Suggestion

The policy below is actually the correct policy:

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "s3:DeleteObject",
                "s3:GetObject",
                "s3:PutObject"
            ],
            "Resource": [
                "arn:aws:s3:::cloudavail-milvus/*"
            ]
        },
        {
            "Effect": "Allow",
            "Action": [
                "s3:ListBucket"
            ],
            "Resource": [
                "arn:aws:s3:::cloudavail-milvus"
            ]
        }
    ]
}

Anything else?

I'll submit a PR with the corrected policy.