CODEWITHSUNDEEP
amazon-s3
zdenko.s
zdenko.s

Reputation: 1032

How to specify AWS S3 bucket policy

My goal is to create technical user who will have only API access and set of allowed actions to specific S3 bucket.

I used "Policy generator" and copy/pasted ARN of the bucket. I also copy/pasted ARN of the user (IAM console-user profile). To make test simpler, I granted access to all actions ("s3:*)

During user creation I did not grant any right. I only checked "Use Access keys" and downloaded credentials.csv file.

Testing scenario is following:

Here is my policy I applied to bucket:

{
"Id": "Policy4321",
"Version": "2012-10-17",
"Statement": [
    {
        "Sid": "Stmt12345",
        "Action": "s3:*",
        "Effect": "Allow",
        "Resource": "arn:aws:s3:::my-bucket-name",
        "Principal": {
            "AWS": [
                "arn:aws:iam::111111111111:user/svc_acc"
            ]
        }
    }
  ]
}

What is wrong with my approach?

Upvotes: 0

Views: 175

Answers (1)

Vikyol
Vikyol

Reputation: 5625

Your approach is fine, but your policy is not correct.

This policy only applies to the bucket itself, but not to the objects it holds. So depending on the command you invoke, you may get "Access Denied". Add /* to your bucket ARN to apply it to the objects.

"Resource": "arn:aws:s3:::my-bucket-name/*"

However, I would use IAM policies in this case as it is bound to a user. You can also easily check what the user can access just by checking his/her attached policy.

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "s3:PutObject",
        "s3:GetObject",
        "s3:DeleteObject"
      ],
      "Resource": ["arn:aws:s3:::my-bucket-name/*"]
    }
  ]
}

Upvotes: 0

Related Questions