CODEWITHSUNDEEP
amazon-web-servicesamazon-s3amazon-iam
208_man
208_man

Reputation: 1728

How do you create an ARN that specifies all S3 buckets in a specific account?

I'm tasked with creating an IAM policy in AWS which grants a user access to all s3 objects in all s3 buckets within a specific account.

However, because s3 bucket names are globally unique, and there being no region or account element in an s3 ARN, it would appear that there's no way to grant access to all s3 objects in one specific account. I must grant it either to specific buckets, or all buckets in all accounts. Is that true? There must be a work around.

I want something like:  

"Resource": "arn:aws:s3::<accountid>:*"

not:  

"Resource": "arn:aws:s3:::*"

Anyone see any solution? I did already read this other related discussion

Upvotes: 3

Views: 6998

Answers (1)

MisterSmith
MisterSmith

Reputation: 3624

You can add conditions to S3 resource policies, one of them is s3:ResourceAccount which should allow you to use the ARN arn:aws:s3:::* but still restrict access to only buckets in your account.

https://aws.amazon.com/blogs/storage/limit-access-to-amazon-s3-buckets-owned-by-specific-aws-accounts/

Upvotes: 5

Related Questions