Is there an S3 policy for limiting access to only see/access one bucket?

user_523811 0
Viewed 111818

I have a simple bucket that looks like images.mysite.com on my S3 and other buckets containing backups, etc.

I want to allow a specific user to be able to access the images.mysite.com bucket in order to upload images. However, I DO NOT want him to see any of the other buckets; not even that they exist.

I could not make a policy that does this; every time I try something restrictive, it ends up blocking the listing of any buckets.

bucket policy amazon-s3
23 Answers

I found this solution:
AWS FLOW:
AWS FLOW

Bucket policy:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Deny",
      "Principal": "*",
      "Action": "s3:*",
      "Resource": [
        "arn:aws:s3:::MyExampleBucket",
        "arn:aws:s3:::MyExampleBucket/*"
      ],
      "Condition": {
        "StringNotLike": {
          "aws:userId": [
            "AROAEXAMPLEID:*", #Role ID
            "111111111111" #AccountID
          ]
        }
      }
    }
  ]
}

IAM policy:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Deny",
      "Principal": "*",
      "Action": "s3:*",
      "Resource": [
        "arn:aws:s3:::MyExampleBucket",
        "arn:aws:s3:::MyExampleBucket/*"
      ],
      "Condition": {
        "StringNotLike": {
          "aws:userId": [
            "AROAEXAMPLEID:*",  #Role ID
            "AIDAEXAMPLEID",  #UserID
            "111111111111"  #AccountID
          ]
        }
      }
    }
  ]
}

aws iam get-user -–user-name USER-NAME --profile=ExampleProfile

aws iam get-role --role-name ROLE-NAME --profile=ExampleProfile

Source: https://aws.amazon.com/blogs/security/how-to-restrict-amazon-s3-bucket-access-to-a-specific-iam-role/

P.S. be careful with bucket policy, you can stay out without permissions

user_86070840

As it has been well discussed above, listing only one bucket on console is not possible. But if S3 bucket's access is attached to an IAM, IAM can directly access the bucket if URL to bucket is available. S3 bucket url will be like:

https://s3.console.aws.amazon.com/s3/buckets/BucketName

Where BucketName is name of bucket IAM has access to

user_13721490

Similar to what others described above:

{
   "Version":"2012-10-17",
   "Statement":[
      {
         "Effect":"Allow",
         "Action":[
            "s3:ListBucket"
         ],
         "Resource":"arn:aws:s3:::awsexamplebucket"
      },
      {
         "Effect":"Allow",
         "Action":[
            "s3:PutObject",
            "s3:GetObject"
         ],
         "Resource":"arn:aws:s3:::awsexamplebucket/*"
      }
   ]
}

Here is however the missing piece. While it is not possible to access the bucket through S3->Home, it is possible to access only the desired bucket through a direct link.

https://s3.console.aws.amazon.com/s3/buckets/yourawsbucket/

You can find more information in the following post:

https://aws.amazon.com/premiumsupport/knowledge-center/s3-console-access-certain-bucket/

user_122509860

While it's not possible to restrict s3:ListAllMyBuckets action to specific buckets, as for workaround you can send them Console URL for specific bucket, e.g.

  • https://s3.console.aws.amazon.com/s3/buckets/BUCKET_NAME/

Source: Restricting list of S3 buckets from the S3 Console

In order to do that, you'll need to specify the following policy document for given user or group:

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "s3:ListBucket",
                "s3:GetBucketLocation",
                "s3:ListBucketMultipartUploads"
            ],
            "Resource": [
                "arn:aws:s3:::my-bucket-1",
                "arn:aws:s3:::my-bucket-2"
            ]
        },
        {
            "Effect": "Allow",
            "Action": [
                "s3:AbortMultipartUpload",
                "s3:DeleteObject",
                "s3:DeleteObjectVersion",
                "s3:GetObject",
                "s3:GetObjectAcl",
                "s3:GetObjectVersion",
                "s3:GetObjectVersionAcl",
                "s3:PutObject",
                "s3:PutObjectAcl",
                "s3:PutObjectVersionAcl"
            ],
            "Resource": [
                "arn:aws:s3:::my-bucket-1/*",
                "arn:aws:s3:::my-bucket-2/*"
            ]
        },
        {
            "Effect": "Allow",
            "Action": [
                "s3:ListAllMyBuckets"
            ],
            "Resource": "arn:aws:s3:::*"
        }
    ]
}

Where my-bucket-1 and my-bucket-2 are your buckets to give the read and write access.

Related:

user_550750

Try this policy. User cannot list any bucket, they have to use direct link to allowed bucket.

For example: s3.console.aws.amazon.com/s3/buckets/bucketname/?region=us-east-1&tab=overview

{
  "Statement": [
    {
      "Action": [
        "s3:ListBucket"
      ],
      "Effect": "Allow",
      "Resource": [
        "arn:aws:s3:::bucketname"
      ]
    },
    {
      "Action": [
        "s3:PutObject",
        "s3:GetObject"
      ],
      "Effect": "Allow",
      "Resource": [
        "arn:aws:s3:::bucketname*"
      ]
    },

  ],
  "Version": "2012-10-17"
}
user_9949290

A nice simple solution we came up with is to block the user to login to the root directory. So they must login with remote path set to desired folder. 

 {
"Statement": [
    {
        "Effect": "Allow",
        "Action": "s3:*",
        "Resource": "arn:aws:s3:::folder-name*",
        "Condition": {}
    }
]
}
user_3975550

No, it's not currently possible to limit users to view selective buckets under root or anywhere else. You have only those 3 options right now.

I chose to ask the client to use the bucket name explicitly.

user_98754360
Related