CODEWITHSUNDEEP
amazon-web-servicesamazon-iamresource-based-authorization
Amit Meena
Amit Meena

Reputation: 4454

Error while creating resource based policy

Trying to create a resource-based policy and specifying a group as principal but it is failing,

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Principal": {
                "AWS": "arn:aws:iam::<acc_number>:group/dev-group"
            },
            "Action": "s3:GetObject",
            "Resource": "arn:aws:s3:::<bucket>/text.txt"
        }
    ]
}

It fails with error:

enter image description here

Upvotes: 0

Views: 380

Answers (1)

Caldazar
Caldazar

Reputation: 3812

This is not possible, per AWS documentation.

You can specify any of the following principals in a policy:

  • AWS account and root user
  • IAM users
  • Federated users (using web identity or SAML federation)
  • IAM roles
  • Assumed-role sessions
  • AWS services
  • Anonymous users (not recommended)

JSON policy documentation

AWS support forum

Upvotes: 1

Related Questions