CODEWITHSUNDEEP
amazon-web-servicesamazon-s3auth0bucket
user3449953
user3449953

Reputation: 53

Auth0 and S3 Buckets

I have a question. I'm using Auth0 and AWS SDK to access to some buckets on S3. I have a question. Is there any way to restrict the access to S3 Buckets without he use of bucket policies? Maybe using metadata provided by Auth0.

Thanks for all

Upvotes: 0

Views: 1954

Answers (2)

johannesboyne
johannesboyne

Reputation: 206

Maybe you're looking for something like this https://github.com/auth0/auth0-s3-sample to restrict access for users on their resources.

IAM Policy for user buckets (restricted to these users only)

{
  "Version": "2012-10-17",
  "Statement": [{
      "Sid": "AllowEverythingOnSpecificUserPath",
      "Effect": "Allow",
      "Action": [
        "*"
      ],
      "Resource": [
          "arn:aws:s3:::YOUR_BUCKET/dropboxclone/${saml:sub}",
          "arn:aws:s3:::YOUR_BUCKET/dropboxclone/${saml:sub}/*"]
   },
   {
      "Sid": "AllowListBucketIfSpecificPrefixIsIncludedInRequest",
      "Action": ["s3:ListBucket"],
      "Effect": "Allow",
      "Resource": ["arn:aws:s3:::YOUR_BUCKET"],
      "Condition":{
        "StringEquals": { "s3:prefix":["dropboxclone/${saml:sub}"] }
       }
    }
  ]
}

But, if the users have shareable group folders it may become more tricky, I'm looking into it myself a.t.m. Checkout this pdf: https://www.pingidentity.com/content/dam/pic/downloads/resources/ebooks/en/amazon-web-services-ebook.pdf?id=b6322a80-f285-11e3-ac10-0800200c9a66 on page 11 LEVERAGE OPENID CONNECT FOR AWS APIS the use case is similar.

So, an option could be to do the following

[USER] -> [Auth0] -> [AWS (Federation/SAML)] -> [exchange temporary AWS credentials] -> [use temp. credentials to access S3]

Hope it helped and even if it is quite a long time ago you asked this question, other users maybe benefit. If you've found a better solution, please share it.

Upvotes: 1

mgonto
mgonto

Reputation: 6595

To restrict access to S3 buckets you must use Amazon IAM.

When using Auth0, you're basically exchanging your Auth0 token for an Amazon Token. Then, with that Amazon token you're calling S3. That means that in order to restrict access to certain parts of S3 you're going to have to change the permissions on Amazon's token, which means you'll need to play with IAM.

Makes sense?

Cheers!

Upvotes: 0

Related Questions