IAM Permissions needed to deploy and sync stack

[cbarlow1993]

I'm trying to identify which IAM permissions are needed to deploy this stack. I can deploy with full admin rights but not with limited.

I have the correct permissions to deploy the stack to cloud formation and all the resources, but it consistently fails when trying to sync the resources and I've burnt too many hours now trying to identify which is needed. (AWS doesn't seem to help with identifying what's required and neither does the verbose logging!)

I've tried and get AccessDenied: Access Denied.

{
  Effect: 'Allow',
  Action: ['*'],
  Resource: ['arn:aws:s3:::*'],
}

[tkgregory]

You'll likely need the same permissions as the aws s3 sync command.

• s3:DeleteObject
• s3:GetBucketLocation
• s3:GetObject
• s3:ListBucket
• s3:PutObject

(source)

Note: if you're missing s3:DeleteObject, the plugin will sync successfully, but stale items will remain in your S3 bucket.