Deny access to all users except one to access private-folder inside S3 bucket

user_8211528 0
Viewed 358

I have a public S3 bucket which has 2 folders inside it, public-folder and private-folder

I want everyone to access the public-folder and I want only user1 to access private-folder programmatically.

Inside the S3 bucket, I have added the following policy:

{
    "Version": "2012-10-17",
    "Id": "Policy1568654876568",
    "Statement": [
        {
            "Effect": "Allow",
            "Principal": "*",
            "Action": "s3:GetObject",
            "Resource": "arn:aws:s3:::my-bucket/*"
        },
        {
            "Effect": "Deny",
            "NotPrincipal": {
                "AWS": [
                    "arn-of-user1"
                ]
            },
            "Action": "s3:GetObject",
            "Resource": "arn:aws:s3:::my-bucket/private-folder/*"
        }
    ]
}

from the IAM, I have created a policy for user1 to be able to access the bucket:

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Action": [
                "s3:ListBucket"
            ],
            "Effect": "Allow",
            "Resource": "arn:aws:s3:::my-bucket"
        },
        {
            "Action": [
                "s3:DeleteObject",
                "s3:GetObject",
                "s3:PutObject"
            ],
            "Effect": "Allow",
            "Resource": "arn:aws:s3:::my-bucket/*"
        }
    ]
}

Is there a better way to achieve this goal? Would be possible to deny everyone to access the private-folder using S3 policy and then override that using IAM policy that I have defined for user1?

amazon-iam amazon-web-services amazon-s3
1 Answers

Wouldn't the following be easier and more natural to do if you have public-folder and private-folder. The following is based on the fact that buckets and its objects are private by default.

Bucket policy

It allows public access to public-folder:

{
    "Version": "2012-10-17",
    "Id": "Policy1568654876568",
    "Statement": [
        {
            "Effect": "Allow",
            "Principal": "*",
            "Action": "s3:GetObject",
            "Resource": "arn:aws:s3:::my-bucket/public-folder/*"
        }
    ]
}

User policy

It allows putting, getting and deleting objects in private-folder, as well as listing the bucket.

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Action": [
                "s3:ListBucket"
            ],
            "Effect": "Allow",
            "Resource": "arn:aws:s3:::my-bucket"
        },
        {
            "Action": [
                "s3:DeleteObject",
                "s3:GetObject",
                "s3:PutObject"
            ],
            "Effect": "Allow",
            "Resource": "arn:aws:s3:::my-bucket/private-folder/*"
        }
    ]
}

Would be possible to deny everyone to access the private-folder using S3 policy and then override that using IAM policy that I have defined for user1?

Explicit deny overwrites any allow. Thus if you deny access to everyone, you can't use any IAM policy to allow access.

user_2488230
Related