CODEWITHSUNDEEP
amazon-web-servicesamazon-s3amazon-iam
Njoi
Njoi

Reputation: 445

how to write a IAM policy to give full s3 access but one directory

I am trying to give all permissions on a single s3 bucket but a single folder. I am trying to use explicit deny the folder name being Beijing path is like buck123-test/china/Beijing/. bucket name is buck123-test.

{
"Version": "2012-10-17",
"Statement": [
    {
        "Sid": "Stmt1561641021576",
        "Action": [
            "s3:ListBucket"
        ],
        "Effect": "Allow",
        "Resource": "arn:aws:s3:::buck123-test"
    },
    {
        "Sid": "Stmt1561639869054",
        "Action": "s3:*",
        "Effect": "Deny",
        "Resource": "arn:aws:s3:::buck123-test/china/Beijing"
    }
]

}

how can i achieve my requirement as the above policy is not working

Upvotes: 0

Views: 158

Answers (2)

Michael Quale
Michael Quale

Reputation: 607

Revised answer, you were missing some critical pieces to the policy document, try this as it should work, but I have not tested this.

You can add additional actions if you want to allow users to GetObject, PutObject etc.

{
  "Id": "Policy1561648158487",
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "Stmt1561648106618",
      "Action": "s3:*",
      "Effect": "Deny",
      "Resource": "arn:aws:s3:::buck123-test/china/Beijing/*",
      "Principal": "*"
    },
    {
      "Sid": "Stmt1561648156125",
      "Action": [
        "s3:ListBucket"
      ],
      "Effect": "Allow",
      "Resource": "arn:aws:s3:::buck123-test/*",
      "Principal": "*"
    }
  ]
}

Upvotes: 0

Sébastien Stormacq
Sébastien Stormacq

Reputation: 14905

Your policy is missing Allow actions for objects in your bucket.

What about ? (not tested myself, let's report if this works)

{
"Version": "2012-10-17",
"Statement": [
    {
        "Sid": "Stmt1561641021576",
        "Action": [
            "s3:*"
        ],
        "Effect": "Allow",
        "Resource": ["arn:aws:s3:::buck123-test", "arn:aws:s3:::buck123-test/*"]
    },
    {
        "Sid": "Stmt1561639869054",
        "Action": "s3:*",
        "Effect": "Deny",
        "Resource": "arn:aws:s3:::buck123-test/china/Beijing/*"
    }
]

}

Note that you need the two resources. The bucket name only resource is required for ListBucket and other bucket level operations. The /* resource is required for object level operations like Put and Get

Upvotes: 2

Related Questions