Cross Account S3 Access for a public buket

user_4414694 0
Viewed 63

Bucket Policy

{
    "Version": "2012-10-17",
    "Id": "Policy1589032691178",
    "Statement": [
        {
            "Sid": "Stmt1589032265458",
            "Effect": "Allow",
            "Principal": "*",
            "Action": "s3:GetObject",
            "Resource": "arn:aws:s3:::<BUCKET>/*"
        }
    ]
}

This will allow read objects to all user.

IAM Policy attached to user ABC in AWS Account 1

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "VisualEditor0",
            "Effect": "Allow",
            "Action": "s3:ListBucket",
            "Resource": "arn:aws:s3:::<BUCKET>"
        },
        {
            "Sid": "VisualEditor1",
            "Effect": "Allow",
            "Action": [
                "s3:PutObject",
                "s3:GetObject",
                "s3:DeleteObject"
            ],
            "Resource": "arn:aws:s3:::<BUCKET>/*"
        }
    ]
}

With this setup public read of objects is there to anyone

And IAM policy is attached to user ABC, so ABC has access to list, put, get, delete

Now the question is If someone in AWS Account 2 creates a user XYZ and attached same IAM policy as above Will the XYZ user in AWS Account 2 be able to list, get, put, delete ?

amazon-iam amazon-web-services amazon-s3
1 Answers

What you posted looks like resource-based & IAM policies cross account access.

In order to allow user XYZ in account 2 to execute mentioned actions on bucket in account 1, apart from policy you specified for user XYZ, you need to additionally specify allowed actions for user XYZ in bucket's policy.

Alternative way is to allow cross-account IAM role assumption, where user in account 2 can assume role in account 1 granting desired access to the S3 bucket in account 1.

More information with examples can be found at https://aws.amazon.com/premiumsupport/knowledge-center/cross-account-access-s3/

user_27125530
Related