AWS Cognito and AWS S3 integration?

Question

Is it possible to restrict AWS S3 objects such that only users who authenticate via AWS Cognito gain access to the object? I haven't figured out a way to do this, but it seems obvious to me that this would be a use case.

I want to host a website via AWS S3 and restrict some objects (my pages) so that if a user were to go them directly they'd get a permission denied error. If the user was authenticated via AWS Cognito tho the object should be available.

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "Deny access to objects in the secured directory.",
            "Effect": "Deny",
            "Principal": "*",
            "Action": "s3:*",
            "Resource": "arn:aws:s3:::domain.com/secured/*"
        },
        {
            "Sid": "Only allowed authenticated users access to a specific bucket.",
            "Effect": "Allow",
            "Principal": {
                "AWS": "arn:aws:iam::x:role/Cognito_Domain_IdP_Auth_Role"
            },
            "Action": "s3:GetObject",
            "Resource": "arn:aws:s3:::domain.com/secured/*"
        },
        {
            "Sid": "Read access for web hosting.",
            "Effect": "Allow",
            "Principal": "*",
            "Action": "s3:GetObject",
            "Resource": "arn:aws:s3:::domain.com/*"
        }
    ]
}

user_10798636 · Answer

You can pass a role to your users authenticated via cognito and then allow them certain actions.

Creating Roles for Role Mapping

It is important to add the appropriate trust policy for each role so that it can only be assumed by Amazon Cognito for authenticated users in your identity pool. Here is an example of such a trust policy:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "",
      "Effect": "Allow",
      "Principal": {
        "Federated": "cognito-identity.amazonaws.com"
      },
      "Action": "sts:AssumeRoleWithWebIdentity",
      "Condition": {
        "StringEquals": {
          "cognito-identity.amazonaws.com:aud": "us-east-1:12345678-dead-beef-cafe-123456790ab"
        },
        "ForAnyValue:StringLike": {
          "cognito-identity.amazonaws.com:amr": "authenticated"
        }
      }
    }
  ]
}

Granting Pass Role Permission

To allow an IAM user to set roles with permissions in excess of the user's existing permissions on an identity pool, you grant that user iam:PassRole permission to pass the role to the set-identity-pool-roles API.

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "Stmt1",
            "Effect": "Allow",
            "Action": [
                "iam:PassRole"
            ],
            "Resource": [
                "arn:aws:iam::123456789012:role/myS3WriteAccessRole"
            ]
        }
    ]
}

More Info here: https://docs.aws.amazon.com/cognito/latest/developerguide/role-based-access-control.html

user_9174350 · Answer

Yes, you can achieve that But for that you can not achieve it directly configuring through the console

→First you need to create policy with limited access of Cognito and S3 bucket

→Create a role attaching them

→Assign them to your EC2 or Lambda

→Authenticate the user in your application using Cognito

→Using that you can have a signed URL for S3 object and retrieve them

This may help you

AWS Cognito and AWS S3 integration?

2 Answers