Why does presigned post require s3:PutObjectAcl permission?

I thought it'd only need the s3:PutObject permission since the object hasn't been created yet.

I did something like:

post = bucket.presigned_post({
  key: "/uploads/${filename}",
  acl: 'public-read'
})

Then, I used the result to create an HTML form to upload a file.

The IAM user (whose credentials I was using) needed the s3:PutObjectAcl permission to do it. Without that permission, I got access denied.

http://ift.tt/1FZREjM