Storage authorizations work for "write" but not for "list"

[newbie33-git]

Environment information

System:
  OS: Linux 5.15 Ubuntu 22.04.5 LTS 22.04.5 LTS (Jammy Jellyfish)
  CPU: (12) x64 12th Gen Intel(R) Core(TM) i5-1235U
  Memory: 4.03 GB / 7.57 GB
  Shell: /bin/bash
Binaries:
  Node: 22.13.1 - ~/.nvm/versions/node/v22.13.1/bin/node
  Yarn: undefined - undefined
  npm: 10.9.2 - ~/.nvm/versions/node/v22.13.1/bin/npm
  pnpm: undefined - undefined
NPM Packages:
  @aws-amplify/auth-construct: 1.3.0
  @aws-amplify/backend: 1.1.1
  @aws-amplify/backend-auth: 1.1.3
  @aws-amplify/backend-cli: 1.2.5
  @aws-amplify/backend-data: 1.1.2
  @aws-amplify/backend-deployer: 1.1.0
  @aws-amplify/backend-function: 1.3.4
  @aws-amplify/backend-output-schemas: 1.2.0
  @aws-amplify/backend-output-storage: 1.1.1
  @aws-amplify/backend-secret: 1.1.0
  @aws-amplify/backend-storage: 1.1.2
  @aws-amplify/cli-core: 1.1.2
  @aws-amplify/client-config: 1.2.1
  @aws-amplify/deployed-backend-client: 1.4.0
  @aws-amplify/form-generator: 1.0.1
  @aws-amplify/model-generator: 1.0.5
  @aws-amplify/platform-core: 1.0.6
  @aws-amplify/plugin-types: 1.2.1
  @aws-amplify/sandbox: 1.2.0
  @aws-amplify/schema-generator: 1.2.1
  aws-amplify: 6.8.0
  aws-cdk: 2.154.1
  aws-cdk-lib: 2.154.1
  typescript: 5.5.4
AWS environment variables:
  AWS_STS_REGIONAL_ENDPOINTS = regional
  AWS_NODEJS_CONNECTION_REUSE_ENABLED = 1
  AWS_SDK_LOAD_CONFIG = 1
No CDK environment variables

Describe the bug

I get this error when using the list function from 'aws-amplify/storage'

import { list } from 'aws-amplify/storage'
const result = await list({
        path: ({identityId}) => `media/{identityId}/`
      })

arn:aws:sts::REDACTEDACCOUNTID:assumed-role/amplify-d3su8b8ts26mem-st-amplifyAuthauthenticatedU-xrRLyt00Gu8C/CognitoIdentityCredentials is not authorized to perform: s3:ListBucket on resource: "arn:aws:s3:::amplify-d3su8b8ts26mem-st-REDACTEDBUCKETNAME760f-k0jit9xertfc" because no identity-based policy allows the s3:ListBucket action

But I am clearly authenticated as I manage to put objects in this bucket, the storage is defined as follows :

import { defineStorage } from '@aws-amplify/backend';

export const storage = defineStorage({
  name: 'REDACTEDBUCKETNAME',
  access: (allow) => ({
    'media/{entity_id}/*': [
      // {entity_id} is the token that is replaced with the user identity id
      allow.entity('identity').to(['write','list'])
    ]
  })
}); 

And I do have an IAM policy attached to this user with permissions PutObject and ListBucket, this policy has been created automatically by aws amplify, I am just stupidly following the docs.

Reproduction steps

Define a storage with permissions write and list

export const storage = defineStorage({
  name: 'REDACTEDBUCKETNAME',
  access: (allow) => ({
    'media/{entity_id}/*': [
      // {entity_id} is the token that is replaced with the user identity id
      allow.entity('identity').to(['write','list'])
    ]
  })
}); 

Try to list in your client code

import { list } from 'aws-amplify/storage'
const result = await list({
        path: ({identityId}) => `media/{identityId}/`
      })

[ykethan]

Hey @newbie33-git, thank you for reaching out and reporting. Noticed the list api call does not have $ on the identityId: https://docs.amplify.aws/react/build-a-backend/storage/list-files/

const data = await list({
        path: ({ identityId }) => `media/${identityId}/`,
      });

Marking this as documentation to update the page

[newbie33-git]

@ykethan Thanks I should have caught it ... What puzzles me is that the policy attached to the auth role seems legit, so the missing $ may not have messed the path...

{
            "Condition": {
                "StringLike": {
                    "s3:prefix": [
                        "media/${cognito-identity.amazonaws.com:sub}/*",
                        "media/${cognito-identity.amazonaws.com:sub}/"
                    ]
                }
            },
            "Action": "s3:ListBucket",
            "Resource": "arn:aws:s3:::amplify-d3su8b8ts26mem-st-REDACTEDBUCKETNAME760f-k0jit9xertfc",
            "Effect": "Allow"
        }

[newbie33-git]

@ykethan I have just added the missing $ and it solved my problem !! What still puzzles me is that the policy posted above has not changed and still seems legit, that is quite mysterious to me ... but hey it works, thanks !

[ykethan]

@newbie33-git the policy generated should not change on the role. As the client request was passing in media/{identityId}/ as a string rather than media/us-east-1:12345678-xxx-xxx-xxx-xxxx which is the folder created on the S3 bucket.

[newbie33-git]

@ykethan ah yes understood thanks !