Aws S3 AccessDenied: when uploading object - node.js

Question

I have a s3 bucket called MyBucket.
The permission like below:
The Bucket Policy:
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Principal": "*",
"Action": "s3:GetObject",
"Resource": [
"arn:aws:s3:::MyBucket/files/*"
]
}
]
}
Inside the bucket, I have a folder called files. Inside files, the object can be viewed by the public
For the IAM user, I have attached an inline policy below:
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": [
"s3:PutObject",
"s3:PutObjectAcl",
"s3:GetObject",
"s3:DeleteObject"
],
"Resource": "arn:aws:s3:::MyBucket/files/*"
}
]
}
When I upload the object to the bucket using nodejs:
s3.upload({
ACL: 'public-read',
Bucket: this.app.settings.aws.s3.bucket,
Body: bufferFromFile,
Key: `files/${result.id}/${data.fileName}`,
}, {}).promise();
I got AccessDenied: Access Denied error.
How to solve it?
Update 1:
I try to add s3:PutObject in bucket policy suggested by the comment, but the error still the same.
I am using EC2 to host the nodejs code
Update 2
I try to upload an object to the bucket using below CLI and it works.
aws s3 cp s3Test.html s3://MyBucket/files/
Update 3
aws s3api put-object --bucket MyBucket --key files/s3Test.html --body s3Test.html --acl public-read
An error occurred (AccessDenied) when calling the PutObject operation: Access Denied
Update 4
just realize there is another Managed policy in same IAM user which might be related.
{
"Version": "2012-10-17",
"Statement": [
{
"Sid": "VisualEditor0",
"Effect": "Allow",
"Action": [
"s3:GetAccessPoint",
"s3:PutAccountPublicAccessBlock",
"s3:GetAccountPublicAccessBlock",
"s3:ListAllMyBuckets",
"s3:ListAccessPoints",
"s3:ListJobs",
"s3:CreateJob",
"s3:HeadBucket"
],
"Resource": "*"
},
{
"Sid": "VisualEditor1",
"Effect": "Allow",
"Action": "s3:*",
"Resource": [
"arn:aws:s3:::MyBucket",
"arn:aws:s3:*:*:accesspoint/*",
"arn:aws:s3:::*/*",
"arn:aws:s3:*:*:job/*"
]
}
]
}
Not sure whether this policy will affect the issue.

Answer 1

It works after removing ACL: 'public-read' from the code.
#Marcin and #John Rotenstein have provided good insight and direction for finding the reasons in the comment. Really appreciate it!
s3.upload({
ACL: 'public-read', //remove this line
Bucket: this.app.settings.aws.s3.bucket,
Body: bufferFromFile,
Key: `files/${result.id}/${data.fileName}`,
}, {}).promise();