AWS S3 Web Console overriding bucket policy

Question

Currently I have a policy applied to a test bucket that is designed to prevent users from uploading s3objects with "public-read" and "public-read-write" ACLs.

When I try to upload via command line the requests are successfully blocked with "Access Denied" as expected:

Write-S3Object -bucketname testbucket -File C:\Users\user\Desktop\DemoFolder\secret_data.txt -cannedACLName public-read

Same result with "public-read-write":

Write-S3Object -bucketname testbucket -File C:\Users\user\Desktop\DemoFolder\secret_data.txt -CannedACLName public-read-write

But when I access the s3bucket via the Web Console GUI I am able to upload public objects. Along with manipulating an existing "private" object to public via the "make public" button.

Here is the bucket policy:

{
"Version": "2012-10-17",
"Statement": [
    {
        "Sid": "DenyPublic",
        "Effect": "Deny",
        "Principal": "*",
        "Action": [
            "s3:PutObject",
            "s3:PutObjectAcl"
        ],
        "Resource": "arn:aws:s3:::testbucket/*",
        "Condition": {
            "StringEquals": {
                "s3:x-amz-acl": [
                    "public-read",
                    "public-read-write"
                ]
            }
        }
    }
]

Also here is the policy for s3 access from the user:

{
"Version": "2012-10-17",
"Statement": [
    {
        "Effect": "Allow",
        "Action": "s3:*",
        "Resource": "*"
    }
]

}

I feel like the fix or logic is really simple. I just cannot put my finger on it.

AWS S3 Web Console overriding bucket policy

1 Answers