Does S3 provide any bucket policy to share the objects to IAM user for a limited time?

Viewed 84

I want to share my bucket (sourcebucket) with an IAM User (testuser) for a limited time window. Does AWS provide any bucket policy so that I can share my bucket objects with the IAM User for a limited time frame?

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "DelegateS3Access",
            "Effect": "Allow",
            "Principal": {
                "AWS": "arn:aws:iam::12345678910:user/testuser"
            },
            "Action": [
                "s3:ListBucket",
                "s3:GetObject"
            ],
            "Resource": [
                "arn:aws:s3:::sourcebucket/*",
                "arn:aws:s3:::sourcebucket"
            ]
        }
    ]
}
1 Answers

Does AWS provide any bucket policy so that I can share my bucket objects with the IAM User for a limited time frame?

Yes.

Check the DateGreaterThan and DateLessThan conditions and the aws:CurrentTime condition key. Here's an example, using the policy in your question as a base:

{
"Version": "2012-10-17",
"Statement": [
    {
        "Sid": "DelegateS3Access",
        "Effect": "Allow",
        "Principal": {
            "AWS": "arn:aws:iam::12345678910:user/testuser"
        },
        "Action": [
            "s3:ListBucket",
            "s3:GetObject"
        ],
        "Resource": [
            "arn:aws:s3:::sourcebucket/*",
            "arn:aws:s3:::sourcebucket"
        ],
        "Condition": {
            "DateGreaterThan": {"aws:CurrentTime": "2020-04-01T00:00:00Z"},
            "DateLessThan": {"aws:CurrentTime": "2020-06-30T23:59:59Z"}
        }
    }
]
}

Here are some useful links:

Related