Storage Lens Permission How to

Question

Hi everyone,

Per the help doc, I've setup an IAM user with the purpose of assigning them Storage Lens permissions. 
https://github.com/awsdocs/amazon-s3-developer-guide/blob/master/doc_source/storage_lens_iam_permissions.md#storage_lens_iam_permissions_account

However in the console,  I can't see any of the permissions mentioned. I only see policies. 
![Policies List](/media/postImages/original/IMnzVE3DkWQNG4YlnU4_DppA)

So are their policies that cover the permissions listed in the article, or do I need to add permissions from somewhere else?

Your help is much appreciated.

Accepted Answer

Hi,

You'd need to create an IAM policy first with the permissions listed in the mentioned [document](https://github.com/awsdocs/amazon-s3-developer-guide/blob/master/doc_source/storage_lens_iam_permissions.md#storage_lens_iam_permissions_account)

1. Go to [IAM Policy console](https://us-east-1.console.aws.amazon.com/iamv2/home?region=us-east-1#/policies)
2. Click **Create policy**
3. Click **JSON** tab at top right OR you can do through Visual as well by selecting those actions one by one
4. Add those actions which are mentioned in the doc, to **Action** part of the policy 
5. Click **Next**
6. Give this policy a name

Here is how JSON document would look like for the policy if I include all the actions as listed under section **Setting account permissions to use S3 Storage Lens** in the above mentioned document. You can add/remove actions based on your requirement and add resource arn instead of '*':

{
     	     "Version": "2012-10-17",
     	     "Statement": [
          		{
		     	     "Sid": "VisualEditor0",
			     "Effect": "Allow",
			     "Action": [
				     "s3:ListStorageLensConfigurations",
				     "s3:GetStorageLensConfiguration",
				     "s3:DeleteStorageLensConfigurationTagging",
				     "s3:PutStorageLensConfigurationTagging",
				     "s3:PutStorageLensConfiguration",
				     "s3:GetStorageLensConfigurationTagging",
				     "s3:GetStorageLensDashboard"
			     ],
			     "Resource": "*"
		     }
	     ]
     }

Once you would have created the policy then you can assign this policy to that IAM user which would be used to access Storage Lens.

Hope you find this helpful.

Comment here if you have additional questions, happy to help.

Abhishek

Answer

Thanks so much Abhishek. That was the missing piece. Hope they add that to the documentation to help new, non-technical users.

Storage Lens Permission How to

Relevant content