CODEWITHSUNDEEP
amazon-s3
pmiranda
pmiranda

Reputation: 8430

AWS create user only with S3 permissions

I know how to create a user through AWS Console en IAM, but I wonder where or how should I set the permissions to that user in order that he only could:

I have this bucket:

enter image description here

So I wonder if I have to set up the permissions in that interface, or directly in the user in IAM service

I'm creating a Group there with this policy:

enter image description here

but for "Write" and "Read" there are a lot of policies, which ones do I need only for write/read files in a specific bucket?

Edit: Currently I have this policy:

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "VisualEditor0",
            "Effect": "Allow",
            "Action": [
                "s3:PutObject",
                "s3:ListBucket",
                "s3:DeleteObject"
            ],
            "Resource": "arn:aws:s3:::static.XXXXXX.com/images/carousel/*",
            "Condition": {
                "BoolIfExists": {
                    "aws:MultiFactorAuthPresent": "true"
                }
            }
        }
    ]
}

I wonder if that is enough to:

Upvotes: 0

Views: 345

Answers (2)

dossani
dossani

Reputation: 1948

You can either use a resource based policy that is attached with S3 or an identity based policy attached to an IAM User, Group or Role.

Identity-based policies and resource-based policies

You can attach below identity policy to the user to upload/delete files to a specific folder in a specific S3 bucket.

{
"Version": "2012-10-17",
"Statement": [
    {
        "Sid": "VisualEditor0",
        "Effect": "Allow",
        "Action": [
            "s3:PutObject",
            "s3:DeleteObject"
        ],
        "Resource": "arn:aws:s3:::SAMPLE-BUCKET-NAME/foldername"
    }
]

}

For more details, refer Grant Access to User-Specific Folders in an Amazon S3 Bucket

Upvotes: 0

Robert Kossendey
Robert Kossendey

Reputation: 6998

You can attach a role to that user that gets a custom policy (Doc).

There you can choose the service, the actions which you want to allow and also the resource which are whitelisted.

Upvotes: 1

Related Questions