AWS S3 IAM grant access to buckets based on tags

user_771246 0
Viewed 9368

I'm trying to grant a group of users access to all s3-buckets with a certain tag, but no access to all others. The policy I've cobbled together looks like this:

    {
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "AllowListAll",
            "Effect": "Allow",
            "Action": [
                "s3:ListAllMyBuckets"
            ],
            "Resource": [
                "arn:aws:s3:::*"
            ]
        },
        {
            "Sid": "AllowAllIfGroup",
            "Effect": "Allow",
            "Action": [
                "s3:*"
            ],
            "Condition: : {
                "StringEquals" : {
                        "s3.ResourceTag/allow-group": "s3-access-group"
                }
            },
            "Resource": [
                "arn:aws:s3:::*",
                "arn:aws:s3:::*/*"
            ]
        }
    ] 
}

and I can't get it to work I have tried simulating the policy for ListBucket and ListAllMyBuckets against the arn of a tagged Bucket, ListAllMyBuckets works, ListBucket fails.

If I adapt this policy to ec2 (as in 'grant start/stop/terminate to instances if tag matches') it works like a charm.

Is this possible at all or does S3 not allow for matching buckets this way?

(further clarification: my bucket has tags "allow-group" and "AllowGroup" set, I was not sure if the dash may be a problem)

amazon-iam amazon-web-services amazon-s3
3 Answers
user_75933300

AWS docs has a reference for all services which have support for use with AWS IAM and resource tagging here https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_aws-services-that-work-with-iam.html

At the moment, only object level tagging in S3 is supported:

¹ Amazon S3 supports tag-based authorization for only object resources.

² Amazon S3 supports service-linked roles for Amazon S3 Storage Lens.

Digging into the docs more, it appears as though PUT and DELETE operations on objects is not supported at the time of writing: https://docs.aws.amazon.com/AmazonS3/latest/userguide/tagging-and-policies.html

user_41375420
Related