I have an AWS sandbox with an s3 bucket. As a test, a few objects are in Glacier.

I have a user with full S3 access and IAM creds for testing. The user's s3 permissions are basically S3:*. And my understanding (based on the below documentation) is the user should need s3:restore:

https://docs.aws.amazon.com/AmazonS3/latest/API/API_RestoreObject.html

But even a user with full S3:* permissions cannot restore S3 objects with Storage Class 'glacier'? That doesn't make sense.

Edit:

For now, I'm testing using a tool called S3 Browser. And I want my user to restore and download a file from s3 (see link below).

https://imgur.com/a/X5Lx1Dv

The storage class is glacier, and s3 browser does allow me to initiate a restore. But the file stays in state 'glacier'. And I'm not sure what permissions I need to allow a user to download this file.

Edit 2: Edited for clarity.