amazon web services - S3 IAM policy works in simulator, but not in real life -

i have client want able upload files, not navigate freely around s3 bucket. i’ve created them iam user account, , applied following policy:

{     "version": "2012-10-17",     "statement": [         {             "sid": "stmt1416387009000",             "effect": "allow",             "action": [                 "s3:listallmybuckets"             ],             "resource": [                 "arn:aws:s3:::*"             ]         },         {             "sid": "stmt1416387127000",             "effect": "allow",             "action": [                 "s3:listbucket"             ],             "resource": [                 "arn:aws:s3:::progress"             ]         },         {             "sid": "stmt1416387056000",             "effect": "allow",             "action": [                 "s3:abortmultipartupload",                 "s3:putobject"             ],             "resource": [                 "arn:aws:s3:::progress/*"             ]         }     ] } 

there 3 statements:

1. ability list buckets (otherwise can’t see in s3 console when log in)
2. ability list contents of progress bucket
3. ability put objects in progress bucket

the user can log in aws console username , password (and custom account url, i.e. https://account.signin.aws.amazon.com/console). can go s3 section of console, , see list of buckets. however, if click progress following error message:

sorry! denied access that.

i’ve checked iam policy simulator whether user has listbucket permission on bucket’s arn (arn:aws:s3:::progress) , policy simulator says user should allowed.

i’ve logged out , in again target user in case policies refreshed on log out, still no joy.

what have done wrong? have missed something?

my guess when using aws console call made bucket location before can list objects in bucket, , user doesn't have permission make call. need give account access getbucketlocation. relevant text documentation

when use amazon s3 console, note when click bucket, console first sends bucket location request find aws region bucket deployed. console uses region-specific endpoint bucket send bucket (list objects) request. result, if users going use console, must grant permission s3:getbucketlocation action shown in following policy statement:

{    "sid": "requiredbys3console",    "action": ["s3:getbucketlocation"],    "effect": "allow",    "resource": ["arn:aws:s3:::*"] }