Disable AWS S3 Management Console

This is a tricky one to implement, however the following should be able to fulfill the requirements.

Programmatic Access Only

You need to define exactly which actions should be denied you would not want to block access completely otherwise you might lose the ability to do anything.

If you're in AWS you should use IAM roles, and a VPC endpoint to connect to the S3 service. Both of these support the ability to control access within your S3 buckets Bucket Policy.

You would use this to deny List* actions where the source is not the VPC endpoint. You could also deny where its not a specific subset of roles.

This works for all programmatic use cases and for people who login as an IAM user from the console, however this does not deny access to the root user.

Also bear in mind for any IAM user/IAM role that they do not have access unless you explicitly give it to them via an IAM policy.

Denying Access To The Root User

There is currently only one way to deny access to the root user of an AWS account (although you should share these credentials with anyone, even within your company) as that is using a Service Control Policy.

To do this the account would need to be part of an AWS organisation (as an organisational unit). If/once it is you would create a SCP that denies access to the root principal for the specific actions that you want.

An example of this policy for you would be

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "RestrictS3ForRoot",
      "Effect": "Deny",
      "Action": [
        "s3:List*"
      ],
      "Resource": [
        "*"
      ],
      "Condition": {
        "StringLike": {
          "aws:PrincipalArn": [
            "arn:aws:iam::*:root"
          ]
        }
      }
    }
  ]
}

Yes, it is possible to disable the Management Console: Don't give users a password.

When creating IAM Users, there are two ways to provide credentials:

• Sign-in Credentials (for the Console)
• Access Key (for API calls)

Only give users an Access Key and they won't be able to login to the console.

However, please note that when when using the Management Console, users have exactly the same permissions as using an Access Key. Thus, if they can do it in the console, then they can do it via an API call (if they have an Access Key).

If your goal is to prevent anyone from accessing customer files, then you can add a Bucket Policy with a Deny on s3:* for the bucket, where the Principal is not the customer.

Please note, however, that the Root login can remove such a policy.

If the customers really want to keep their own data private, then they would need to create their own AWS account and keep their files within it, without granting you access.