IAM AWS S3 to restrict to a specific sub-folder

Question

I'm using AWS S3 component to store files.

I have a bucket called "mybucket" and with the following folders :

+---Mybucket
\---toto1
\---toto2
+---toto3
|   \--- subfolder
|       \---subsubfolder
\---toto4

I have AWS console users that need only need to access "toto3" folder.

I tried to restrict the access to this folder, but the user must have the right to list the root of bucket. If I put additional rights to acces the root folder, users can browser "toto1" and "toto2" folders and I don't want.

I want to configure something like that:

Authorize to list all buckets of my S3 account (listAllBuckets policy)
Autorize to list the root of the bucket (it's OK for me if the user see the directories names)
Deny access for all prefix bucket different from "toto3"
Autorize every actions for the user in toto3 folder
I don't want to write an inclusive rules

I tried this IAM policy without any success :

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "s3:ListBucket",
                "s3:PutObject",
                "s3:GetObject"
            ],
            "Resource": ["arn:aws:s3:::mybucket/toto3/*"]
        },
        {
            "Sid": "Stmt1457617383000",
            "Effect": "Allow",
            "Action": [
                "s3:GetBucketLocation",
                "s3:ListBucket"
            ],
            "Resource": ["arn:aws:s3:::mybucket"]
        },
        {
            "Sid": "Stmt1457617230000",
            "Effect": "Deny",
            "Action": ["s3:*"],
            "Condition": {
                "StringNotLike": {
                    "s3:prefix": "toto3*"
                }
            },
            "Resource": [
                "arn:aws:s3:::mybucket/*"
            ]
        },
        {
            "Effect": "Allow",
            "Action": [
                "s3:ListAllMyBuckets"
            ],
            "Resource": [
                "*"
            ]
        }
    ]
}

user_6697423 · Answer

I need to grant an external vendor access only to a subfolder under a folder, that was under a bucket (!!!). Something like this:

bucket/folder/subfolder

Here's how I accomplished it:

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "VisualEditor0",
            "Effect": "Allow",
            "Action": [
                "s3:PutObject",
                "s3:GetObject",
                "s3:ListBucket",
                "s3:DeleteObject",
                "s3:GetBucketLocation"
            ],
            "Resource": [
                "arn:aws:s3:::bucket/*",
                "arn:aws:s3:::bucket"
            ]
            "Condition": {
                "StringLike": {
                    "s3:prefix": [
                        "bucket/folder/subfolder/*",
                        "bucket/folder/subfolder/",
                        "bucket/folder/subfolder",
                        "folder/subfolder/*",
                        "folder/subfolder/",
                        "folder/subfolder",
                    ]
                }
            }
        }
    ]
}

user_9447865 · Answer

Is it possible to limit the below rule but give specific folder access? I don't want the user see the directory names/folder names with-in the specific bucket.

Autorize to list the root of the bucket (it's OK for me if the user see the directories names)

IAM AWS S3 to restrict to a specific sub-folder

4 Answers