CODEWITHSUNDEEP
amazon-web-servicessecurityamazon-s3amazon-iam
Mikael Dúi Bolinder
Mikael Dúi Bolinder

Reputation: 2284

Can you use tags to give access to S3 Buckets?

I just tried adding tags to some buckets and then I created an inline IAM role policy that'd give that role access to the S3 buckets however that didn't work. I tried both iam:ResourceTag/tagName and s3:ResourceTag/tagName as conditionals but neither worked.

As everything looked just fine I started thinking that AWS might not have implemented this yet for S3. Is that the case? I tried reviewing documentation and indeed I didn't find anything about this use of tags working with S3.

For example the role HumanResources should have to all buckets tagged with HR, Recruitment etc. but no other buckets.

Upvotes: 1

Views: 2648

Answers (2)

WaltDe
WaltDe

Reputation: 1832

Yes you can but you will need do on each S3 Resource Policy.

Here is an S3 Policy to grant access to the bucket for only IAM users and roles with a Tag department set to "hr".

To ensure HR employee only have access to these buckets you will need to remove all S3 access from their IAM user/role access polices.

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "DenyObjectOthers",
      "Effect": "Deny",
      "Principal": "*",
      "Action": [
        "s3:AbortMultipartUpload",
        "s3:ListMultipartUploadParts",
        "s3:DeleteObject*",
        "s3:PutObject*",
        "s3:GetObject*",
        "s3:RestoreObject*"
      ],
      "Resource": [
        "arn:aws:s3:::BUCKET_NAME/*"
      ],
      "Condition": {
        "StringNotLike": {
          "aws:PrincipalTag/department": [
            "hr"
          ]
        }
      }
    },
    {
      "Sid": "DenyListOthers",
      "Effect": "Deny",
      "Principal": "*",
      "Action": [
        "s3:ListBucket*"
      ],
      "Resource": [
        "arn:aws:s3:::BUCKET_NAME"
      ],
      "Condition": {
        "StringNotLike": {
          "aws:PrincipalTag/department": [
            "hr"
          ]
        }
      }
    },
    {
      "Sid": "AllowObject",
      "Effect": "Allow",
      "Principal": {
        "AWS": "arn:aws:iam::AWS_ACCOUNT_NUMBER:root"
      },
      "Action": [
        "s3:AbortMultipartUpload",
        "s3:ListMultipartUploadParts",
        "s3:DeleteObject*",
        "s3:PutObject*",
        "s3:GetObject*",
        "s3:RestoreObject*"
      ],
      "Resource": [
        "arn:aws:s3:::BUCKET_NAME/*"
      ],
      "Condition": {
        "StringLike": {
          "aws:PrincipalTag/department": [
            "hr"
          ]
        }
      }
    },
    {
      "Sid": "AllowList",
      "Effect": "Allow",
      "Principal": {
        "AWS": "arn:aws:iam::AWS_ACCOUNT_NUMBER:root"
      },
      "Action": [
        "s3:ListBucket*"
      ],
      "Resource": [
        "arn:aws:s3:::BUCKET_NAME"
      ],
      "Condition": {
        "StringLike": {
          "aws:PrincipalTag/department": [
            "hr"
          ]
        }
      }
    }
  ]
}

Previous Wrong Answer From: IAM Policy Elements: Variables and Tags - AWS Identity and Access Management

    "Resource": ["arn:aws:s3:::bucket/${aws:PrincipalTag/department}"]

Also make sure to include the version at 2012-10-17.

Upvotes: 1

John Rotenstein
John Rotenstein

Reputation: 269470

In looking at Actions, Resources, and Condition Keys for Amazon S3 - AWS Identity and Access Management, there does not appear to be the ability to specify a Bucket Tag in an IAM Policy.

One alternative is to use a wildcard in a bucket name. For example, you could grant permission to access:

acme-hr-1

You could grant permissions based on a bucket name of acme-hr-*.

Upvotes: 1

Related Questions