Can I use PrincipalTag in resource arn within AWS IAM policy to authorize a team?

Viewed 220

I have s3 buckets named as per team names. For example the below policy works if I want to provide Get, List permissions by using a PrincipalTag in Condition operator. But I'll have to define similar policy by changing the S3 arn for every team.

{
"Version": "2012-10-17",
"Statement": [
    {
        "Effect": "Allow",
        "Action": [
            "s3:ListBucket"
        ],
        "Resource": "*"
    },
    {
        "Sid": "VisualEditor0",
        "Effect": "Allow",
        "Action": [
            "s3:PutObject",
            "s3:GetObject"
        ],
        "Resource": [
            "arn:aws:s3:::companyName-TeamName*",
            "arn:aws:s3:::companyName-TeamName*/*"
        ],
        "Condition": {
            "StringEquals": {
                "s3:ExistingObjectTag/teamname": "${aws:PrincipalTag/teamname}"
            }
        }
    }
]
}

What if I want to define the resource arn using the PrincipalTag like below

 {
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "s3:ListBucket"
            ],
            "Resource": "*"
        },
        {
            "Sid": "VisualEditor0",
            "Effect": "Allow",
            "Action": [
                "s3:PutObject",
                "s3:GetObject"
            ],
            "Resource": [
                "arn:aws:s3:::companyName-${aws:PrincipalTag/teamname}*",
                "arn:aws:s3:::companyName-${aws:PrincipalTag/teamname}*/*"
            ],
            "Condition": {
                "StringEquals": {
                    "s3:ExistingObjectTag/teamname": "${aws:PrincipalTag/teamname}"
                }
            }
        }
    ]
}

All teams assumes their roles which has a tag 'teamname':'Their Team Name'

Can I define a policy like this? This will reduce the redundancy of policies. I do not want to define all the S3 arns in the resource section, it will be long list of teams and their buckets.

0 Answers
Related