CODEWITHSUNDEEP
amazon-web-servicesamazon-s3
TravelingLex
TravelingLex

Reputation: 477

How to give external AWS IAM user access to specific S3 Bucket folder

I need to give external users access to a single Amazon S3 bucket folder. I have their ARN information but I am having an issue granting access. 

{
    "Version": "2012-10-17",
    "Id": "S3AccessPolicy",
    "Statement": [
        {
            "Sid": "TestAccess",
            "Effect": "Allow",
            "Principal": {
                "AWS": "<external ARN>"
            },
            "Action": [
                "s3:GetObject",
                "s3:ListBucket"
            ],
            "Resource": [
                "arn:aws:s3:::rootlevelbucket",
                "arn:aws:s3:::rootlevelbucket/specificfolder/*"
            ]
        }
    ]
}

Upvotes: 1

Views: 2993

Answers (1)

WaltDe
WaltDe

Reputation: 1832

There is 2 sides to cross account access. You have the first part with the bucket policy, but the admin for the external account needs to grant the user access to the S3 with a IAM policy like below. You can use the s3:* on the IAM policy because you bucket policy will restrict to just the commands you list.

AWS Documentation

IAM Policy for external user:

{
   "Version": "2012-10-17",
   "Statement": [
      {
         "Sid": "RootlevelbucketAccess",
         "Effect": "Allow",
         "Action": [
            "s3:*"
         ],
         "Resource": [
             "arn:aws:s3:::rootlevelbucket",
             "arn:aws:s3:::rootlevelbucket/specificfolder/*"
         ]
      }
   ]
}

Upvotes: 3

Related Questions