CODEWITHSUNDEEP
amazon-web-servicesamazon-s3amazon-iam
pkaramol
pkaramol

Reputation: 19412

Allowing EC2 instance to access bucket that has deny policy attached to it

I have a bucket with a deny policy attached to it, more or less like this

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "RestrictedAccess",
            "Effect": "Deny",
            "NotPrincipal": {
                "AWS": [
                    "arn:aws:iam::1234567890:user/someuser@somecompany",
                ]
            },
            "Action": "s3:*",
            "Resource": [
                "arn:aws:s3:::my-bucket",
                "arn:aws:s3:::my-bucket/*"
            ]
        }
    ]
}

It is evident, that even if I grant IAM permissions to an IAM user/role to access the bucket, the above Deny will prevail.

Now, I want to create an EC2 instance that should also have access to this bucket.

What type of principal should I add here

                "AWS": [
                    "arn:aws:iam::1234567890:user/someuser@somecompany",
                ]
            },

Upvotes: 0

Views: 37

Answers (1)

Maurice
Maurice

Reputation: 13187

You have to add the ARN of the Role the EC2 instance is using to your Deny exception and add an explicit allow to the role for the S3 operations you wish to perform.

Upvotes: 1

Related Questions