# "Download Exported Course" from S3

**URL:** <https://discuss.openedx.org/t/download-exported-course-from-s3/4650>\
**Category:** Site Operations Help\
**Created:** [April 1, 2021, 6:53am UTC](https://discuss.openedx.org/t/download-exported-course-from-s3/4650 "2021-04-01T06:53:21Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![guangyaw](https://avatars.discourse-cdn.com/v4/letter/g/b38774/32.png) [@guangyaw](https://discuss.openedx.org/u/guangyaw)\
**Post date:** [April 1, 2021, 6:53am UTC](https://discuss.openedx.org/t/download-exported-course-from-s3/4650/1 "2021-04-01T06:53:21Z")

</div>

Version : Koa native installation

 ![ds3-000](https://us1.discourse-cdn.com/flex020/uploads/openedx/original/2X/e/eff0bfbb37d455e2f9a7727ad3a75e69555f0bc1.png)  
As the picture above , I want to download the exported course file from S3.  
But I meet the “Access denied” problem.  
 ![ds3-001](https://us1.discourse-cdn.com/flex020/uploads/openedx/original/2X/3/331c9ab04c060bfff5c7b35f2cdbbf91979a3c90.png)

Below is my S3 bucket rule:

```auto
"Effect": "Allow",
            "Action": [
                "s3:*Object",
                "s3:List*",
                "s3:GetObj*",
                "s3:DeleteObject",
                "s3:DeleteObjectTagging",
                "s3:GetObjectRetention",
                "s3:DeleteObjectVersion",
                "s3:GetObjectVersionTagging",
                "s3:PutObjectVersionTagging",
                "s3:DeleteObjectVersionTagging",
                "s3:PutObjectLegalHold",
                "s3:GetObjectLegalHold",
                "s3:GetObjectVersionTorrent",
                "s3:GetBucketObjectLockConfiguration",
                "s3:GetObjectAcl",
                "s3:GetObjectTorrent",
                "s3:PutObjectRetention",
                "s3:PutObjectVersionAcl",
                "s3:GetObjectVersionAcl",
                "s3:GetObjectTagging",
                "s3:PutObjectTagging",
                "s3:PutBucketObjectLockConfiguration",
                "s3:GetObjectVersionForReplication",
                "s3:PutObjectAcl",
                "s3:GetObjectVersion"
            ],
            "Resource": [
                "arn:aws:s3:::my-bucket",
                "arn:aws:s3:::my-bucket/*"
            ]
```

Is there anything wrong ?

---

<div class="post-metadata">

**Author:** ![guruprasad](https://sea2.discourse-cdn.com/flex020/user_avatar/discuss.openedx.org/guruprasad/32/303_2.png) [@guruprasad](https://discuss.openedx.org/u/guruprasad)\
**Post date:** [April 2, 2021, 7:42pm UTC](https://discuss.openedx.org/t/download-exported-course-from-s3/4650/2 "2021-04-02T19:42:16Z")

</div>

@guangyaw, it is a good idea to have the corresponding IAM user have all the permissions on the bucket. Here is an example from a policy that I have attached to such a user.

```auto
{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "",
            "Effect": "Allow",
            "Action": "s3:*",
            "Resource": [
                "arn:aws:s3:::bucket-name/*",
                "arn:aws:s3:::bucket-name"
            ]
        }
    ]
}

```

Can you try this and let me know if it resolved your problem?

---

<div class="post-metadata">

**Author:** ![guangyaw](https://avatars.discourse-cdn.com/v4/letter/g/b38774/32.png) [@guangyaw](https://discuss.openedx.org/u/guangyaw)\
**Post date:** [April 7, 2021, 7:45am UTC](https://discuss.openedx.org/t/download-exported-course-from-s3/4650/3 "2021-04-07T07:45:36Z")

</div>

No, this could not resolved my problem.  
Still “Access Denied” .