CODEWITHSUNDEEP
amazon-web-servicesamazon-s3aws-cli
StoneThrow
StoneThrow

Reputation: 6275

AWS: What is the relationship between S3 bucket policies and user policies?

What is (or should be) the relationship between a S3 bucket policy and its designated administrator's user policy?

E.g. suppose I've newly created a bucket:

$ aws --profile admin --endpoint-url http://localhost:4572 s3 mb s3://foo
make_bucket: foo

I want user bucket_admin to be able to administer the bucket (not necessarily exclusively). To do this, should I create/apply a bucket policy along the lines of:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": ["s3:*"],
      "Principal": { "AWS": "arn:aws:iam::000000000000:user/bucket_admin" },
      "Resource": "arn:aws:s3:::foo/*"
    }
  ]
}

...or create/apply a user policy along the lines of:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect":"Allow",
      "Action":["s3:*"],
      "Resource":["arn:aws:s3:::foo/*"]
    }
  ]
}

?

Upvotes: 2

Views: 196

Answers (2)

Jaime
Jaime

Reputation: 47

In addition to @Marcin's answer, which is great...

We use bucket policies mostly for bucket-level checks - ensure the traffic is SSL, ensure the traffic originates from a specific VPC, etc.

Using roles attached to IAM users is an easier way of controlling user access.

The exception is where a user is trying to access a bucket in another account - in this case, both a bucket policy and an IAM policy is needed https://docs.aws.amazon.com/AmazonS3/latest/dev/example-walkthroughs-managing-access-example2.html

Upvotes: 0

Marcin
Marcin

Reputation: 238309

Your bucket policy applies to only one principle, the bucket_admin user. It can't be used by a role, other IAM user or a group, if you want to have more identities being able to administer the bucket.

The IAM policy does not have a principle by definition. It means you have to attach it to an identity, such as IAM role, user or group. This gives you more flexibility on how to distribute the permissions to the bucket. It can be only the bucket_admin, or you can create a group of bucket admins, or have role which can be assumed by an EC2 instance.

Also with IAM policy it is easier to check who/what is using it. You just go to IAM console, and to Policy Usage and you will get a list of all identities which use the policy. With bucket policies, you have to go manually over all buckets and inspect their policies to check who can be admin of buckets.

Good general comparison of resource vs IAM policies is here:

Also useful read as IAM policies can be attached to roles:

Upvotes: 5

Related Questions