CODEWITHSUNDEEP
amazon-web-servicesamazon-s3
Manjunath
Manjunath

Reputation: 391

Amazon S3 static Website accessible (403 Error) when secure transport policy added

We have an Amazon S3 static website and it was working fine until we introduced a policy where we allow only secure data transfer by enforcing aws:SecureTransport. A policy with simply denies access to the site when the aws:SecureTransport fails. But when we access the site now, it says 403 Forbidden error.

The set up is that we have CloudFront fronted to this site, so the traffic routes through the CloudFront, not sure if this has to do something with the issue we are facing, where the traffic route between CloudFront and Amazon S3 is http only. Having said that, strangely when we tweek the policy to have aws:SecureTransport:true and allow such requests to the site, it works fine, but when we have deny policy aws:SecureTransport:false, then we end up getting 403 error. Sharing both the policies here.

When we have this the static website works fine:

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "AllowOriginAccessIdentity",
            "Effect": "Allow",
            "Principal": {
                "AWS": "arn:aws:iam::cloudfront:user/CloudFront Origin Access Identity XXXXXXXXXXX"
            },
            "Action": "s3:GetObject",
            "Resource": "arn:aws:s3:::example.domain.com/*"
        },
        {
            "Sid": "ForceSSLRequest",
            "Effect": "Allow",
            "Principal": {
                "AWS": "*"
            },
            "Action": "s3:*",
            "Resource": "arn:aws:s3:::example.domain.com/*",
            "Condition": {
                "Bool": {
                    "aws:SecureTransport": true
                }
            }
        }
    ]
}

Where as when we have as below, it fails, and we want this to be implemented to be absolutely sure:

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "AllowOriginAccessIdentity",
            "Effect": "Allow",
            "Principal": {
                "AWS": "arn:aws:iam::cloudfront:user/CloudFront Origin Access Identity XXXXXXXXXXX"
            },
            "Action": "s3:GetObject",
            "Resource": "arn:aws:s3:::example.domain.com/*"
        },
        {
            "Sid": "ForceSSLRequest",
            "Effect": "Deny",
            "Principal": {
                "AWS": "*"
            },
            "Action": "s3:*",
            "Resource": "arn:aws:s3:::example.domain.com/*",
            "Condition": {
                "Bool": {
                    "aws:SecureTransport": false
                }
            }
        }
    ]
}

Update: I have a policy as below allowing an OAI accessing the S3. This does not work, but when we read/understand the policy it makes sense to allow access the webiste, but it fails :(.

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "AllowOriginAccessIdentity",
            "Effect": "Deny",
            "Principal": {
                "AWS": "arn:aws:iam::cloudfront:user/CloudFront Origin Access Identity XXXXXXXXXXX"
            },
            "Action": "s3:*",
            "Resource": "arn:aws:s3:::example-domain.com/*",
            "Condition": {
                "Bool": {
                    "aws:SecureTransport": "false"
                }
            }
        }
    ]
}

But the below works, even though logical readability is same according to my understanding.

{
        "Version": "2012-10-17",
        "Statement": [
            {
                "Sid": "AllowOriginAccessIdentity",
                "Effect": "Allow",
                "Principal": {
                    "AWS": "arn:aws:iam::cloudfront:user/CloudFront Origin Access Identity XXXXXXXXXXX"
                },
                "Action": "s3:*",
                "Resource": "arn:aws:s3:::example-domain.com/*",
                "Condition": {
                    "Bool": {
                        "aws:SecureTransport": "true"
                    }
                }
            }
        ]
    }

Any help in understanding this behavior is much appreciated.

Upvotes: 2

Views: 933

Answers (1)

John Rotenstein
John Rotenstein

Reputation: 270184

The policy logic is:

  • Explicit Deny by default
  • Use Allow to grant desired access
  • Use Deny to override access given by Allow

Policy evaluation logic

Therefore, the better policy is to Allow access if aws:SecureTransport is true, since it is less permissive and doesn't need any Deny statements (which are always confusing!).

See: Policy evaluation logic - AWS Identity and Access Management

Upvotes: 1

Related Questions