CODEWITHSUNDEEP
amazon-web-servicesamazon-s3
Alon
Alon

Reputation: 11935

Attach existing policies directly for programatically access to S3

I am creating a user that needs a read and write access to S3 programatically.

Under "Attach existing policies directly" there are too many policies and I don't know which of them is the one I need.

Upvotes: 0

Views: 26

Answers (1)

John Rotenstein
John Rotenstein

Reputation: 269826

If you wish to grant one IAM User access to do anything in Amazon S3, you can simply attach the AmazonS3FullAccess policy, which grants:

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": "s3:*",
            "Resource": "*"
        }
    ]
}

However, this lets them do anything (including deleting buckets). Normally, people would be assigned specific permissions for a given bucket, such as this inline policy:

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "s3:PutObject",
                "s3:GetObjectAcl",
                "s3:GetObject",
                "s3:ListBucket",
                "s3:DeleteObject",
                "s3:GetBucketLocation"
            ],
            "Resource": [
                "arn:aws:s3:::my-bucket/*",
                "arn:aws:s3:::my-bucket"
            ]
        },
        {
            "Effect": "Allow",
            "Action": "s3:ListAllMyBuckets",
            "Resource": "*"
        }
    ]
}

Note that some actions apply to the bucket itself, while other applies to the contents (/*) of the bucket.

Upvotes: 1

Related Questions