Amazon S3 bucket policy for anonymously uploading

Question

I am planning on using Amazon S3 to let users upload photos from an iPhone and then let them be publicly viewable.

I am having some trouble understanding how to set up these security constraints in the bucket policy:

• Everyone can read every file.
• Everyone can upload a new file that is maximum 256K large.
• No one can delete any file.
• No one can modify any file.

Answer 1

Perhaps something like the one below will work, but I am not sure you can restrict the upload size.

{
  "Statement": [
    {
      "Effect": "Allow",
      "Principal":"*",
      "Action": [
        "s3:GetObject",
        "s3:PutObject",
        "s3:GetObjectAcl",
        "s3:PutObjectAcl"
      ],
      "Resource": "arn:aws:s3:::mybucket/*",
      "Condition": {}
    },
    {
      "Effect": "Allow",
      "Action": [
        "s3:ListBucket",
        "s3:GetBucketAcl"
      ],
      "Resource": "arn:aws:s3:::mybucket",
      "Condition": {}
    }
  ]
}

Answer 2

Ok I sort of worked it out in the end. The only thing is that you can't set different permissions on adding files and updating files. They are all covered by s3:PutObject. Also, it doesn't seem possible to restrict file size.

{
    "Version": "2008-10-17",
    "Id": "policy",
    "Statement": [
        {
            "Sid": "allow-public-read",
            "Effect": "Allow",
            "Principal": {
                "AWS": "*"
            },
            "Action": "s3:GetObject",
            "Resource": "arn:aws:s3:::bucket/*"
        },
    {
            "Sid": "allow-public-put",
            "Effect": "Allow",
            "Principal": {
                "AWS": "*"
            },
            "Action": "s3:PutObject",
            "Resource": "arn:aws:s3:::bucket/*"
        }
  ]
}