Object level restriction for s3 with IAM Role

Question

I am trying to restrict user access at the object level in S3.

There are 2 folders in the s3 bucket. I am trying to give access to only one folder among the object.

The two folders are:

1. broker
2. carrier

This is the IAM Role policy:

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": "s3:ListAllMyBuckets",
            "Resource": "arn:aws:s3:::*"
        },
        {
            "Effect": "Allow",
            "Action": [
                "s3:ListBucket",
                "s3:GetBucketLocation"
            ],
            "Resource": "arn:aws:s3:::lodeobucket"
        },
        {
            "Effect": "Allow",
            "Action": [
                "s3:PutObject",
                "s3:GetObject",
                "s3:GetObjectVersion",
                "s3:DeleteObject",
                "s3:DeleteObjectVersion"
            ],
            "Resource": "arn:aws:s3:::lodeobucket/broker/*"
        }
    ]
}

But the user is able to access the carrier folder as well.

Could anyone suggest what am I missing?

Answer 1

If you add the following conditon:

"Condition":{"StringLike":{"s3:prefix":["","broker/*"]}}

you user will not be able to enter carrier folder. It will still be visible in console. I don't think you can "hide" other folders, as this will break console access.

You can try the following policy:

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": "s3:ListAllMyBuckets",
            "Resource": "arn:aws:s3:::*"
        },
        {
            "Effect": "Allow",
            "Action": [
                "s3:ListBucket",
                "s3:GetBucketLocation"
            ],
            "Resource": "arn:aws:s3:::lodeobucket",
            "Condition":{"StringLike":{"s3:prefix":["","broker/*"]}}
        },
        {
            "Effect": "Allow",
            "Action": [
                "s3:PutObject",
                "s3:GetObject",
                "s3:GetObjectVersion",
                "s3:DeleteObject",
                "s3:DeleteObjectVersion"
            ],
            "Resource": "arn:aws:s3:::lodeobucket/broker/*"
        }
    ]
}