CODEWITHSUNDEEP
securityamazon-web-servicesamazon-s3
Alex A.
Alex A.

Reputation: 2613

Limiting access to AWS S3 with policy is not working as expected

I have a user group which we use for one of our environments in AWS. We are trying to limit access of that group only to specific S3 bucket.

So, I created a policy as follows:

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": "s3:*",
            "Resource": "arn:aws:s3:::staging"
        }
    ]
}

If I use AWS policy simulator, all shows as expected (at least looks like it). But, through the app, that uses the API key of a user in this group I am getting access denied when I upload a file.

What am I doing wrong?

This gives the same result

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "s3:PutObject",
                "s3:GetObject",
                "s3:GetObjectVersion",
                "s3:DeleteObject",
                "s3:DeleteObjectVersion"
            ],
            "Resource": [
                "arn:aws:s3:::staffila-staging",
                "arn:aws:s3:::staffila-staging/*"
            ]
        }
    ]
}

Upvotes: 0

Views: 46

Answers (1)

Piyush Patil
Piyush Patil

Reputation: 14543

Use this policy this will work.

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": ["s3:ListBucket"],
      "Resource": ["arn:aws:s3:::staging"]
    },
    {
      "Effect": "Allow",
      "Action": [
        "s3:PutObject",
                "s3:GetObject",
                "s3:GetObjectVersion",
                "s3:DeleteObject",
                "s3:DeleteObjectVersion"
      ],
      "Resource": ["arn:aws:s3:::staging/*"]
    }
  ]
}

Upvotes: 1

Related Questions