CODEWITHSUNDEEP
amazon-web-servicesamazon-s3
shantanuo
shantanuo

Reputation: 32304

allow open access to S3 bucket with certain restrictions

How do I set permissions in such a way that anyone can upload files to my bucket?

Here is an example that has these 3 features:

  1. I can upload any file and download my file from anywhere.
  2. But I am not able to download files uploaded by others.
  3. However, I can delete files uploaded by others.

I will like to know how this bucket (abc) was set up and who owns it.

1) I can upload:

[root@localhost ~]# aws s3 cp test.txt s3://abc/
upload: ./test.txt to s3://abc/test.txt

2) I can list contents:

[root@localhost ~]# aws s3 ls s3://abc | head
                           PRE doubleverify-iqm/
                           PRE folder400/
                           PRE ngcsc/
                           PRE out/
                           PRE pd/
                           PRE pit/
                           PRE soap1/
                           PRE some-subdir/
                           PRE swoo/
2018-06-15 12:06:27       2351 0Sw5xyknAcVaqShdROBSfCfa7sdA27WbFMm4QNdUHWqf2vymo5.json

3) I can download my file from anywhere:

[root@localhost ~]# aws s3 cp s3://abc/test.txt .
download: s3://abc/test.txt to ./test.txt

4) But not able to download other's file

[root@localhost ~]# aws s3 cp s3://abc/zQhAqmwIUfIeDnEEHpiaGhXuERgO3bR84jkjhbei1aLiV1758t.json .
fatal error: An error occurred (403) when calling the HeadObject operation: Forbidden

5) however, I can delete the file not uploaded by me:

[root@localhost ~]# aws s3 rm s3://abc/zQhAqmwIUfIeDnEEHpiaGhXuERgO3bR84jkjhbei1aLiV1758t.json
delete: s3://abc/zQhAqmwIUfIeDnEEHpiaGhXuERgO3bR84jkjhbei1aLiV1758t.json

I am not sure how to set-up such a bucket.

Upvotes: 1

Views: 75

Answers (1)

John Rotenstein
John Rotenstein

Reputation: 270144

It is not advisable to setup a bucket in this manner.

The fact that anyone can upload to the bucket means that somebody could store, potentially, TBs of data and you would be liable for the cost. For example, somebody could host large video files, using your bucket for free storage and bandwidth.

Similarly, it is not good security practice to grant permissions for anyone to list the contents of your bucket. They might find sensitive data that was not intended to be released.

It would also be unwise to allow anyone to delete objects from your bucket, because somebody could delete everything!

There are two primary ways to grant access to objects:

Bucket Policy

A Bucket Policy can grant permissions on the whole bucket, or specific paths within a bucket. For example, granting GetObject to the whole bucket means that anyone can download any object.

See: Bucket Policy Examples - Amazon Simple Storage Service

Object-level permissions

Basic permissions can also be granted on a per-object basis. For example, when an object is copied to a bucket, the Access Control List (ACL) can specify who can access the object.

For example, this would grant ownership of the object to the bucket owner:

aws s3 cp foo.txt s3://my-bucket/foo.txt --acl bucket-owner-full-control

If the --acl is excluded, then the object 'belongs' to the identity that uploaded the file, which is why you were download your own file. This is not recommended, because it could lead to a situation where the bucket owner cannot access (and potentially cannot even delete!) the object.

Bottom line: Think about your security before implementing rules that grant other people, or anyone, permissions on your buckets.

Upvotes: 1

Related Questions