Is there any policy variable available for AWS S3 bucket name?

user_10838772 0
Viewed 760

I have multiple s3 buckets and I want to maintain a common bucket policy across all my bucket. My bucket policy contains the bucket name as part of resource name and hence I am not able to maintain a single policy file for all my bucket. Is there any way to fetch the bucket name in the policy using any variable?

{
    "Version": "2012-10-17",
    "Id": "Policy1610615475618",
    "Statement": [
        {
            "Sid": "Stmt1610615465140",
            "Effect": "Deny",
            "Principal": {
                "AWS": "arn:aws:iam::<acc_name>:user/<user_name>"
            },
            "Action": "s3:PutObject",
            "NotResource": [
                "arn:aws:s3:::<bucket-name>/*.PNG",
                "arn:aws:s3:::<bucket-name>/*.JPG",
                "arn:aws:s3:::<bucket-name>/*.txt",
                "arn:aws:s3:::<bucket-name>/*.mp3",
                "arn:aws:s3:::<bucket-name>/*.Docx"
            ]
        }
    ]
}
amazon-web-services amazon-s3
3 Answers

Sadly there is no such variable. Usually in a situation like this you would create and manage your buckets and their policies using Infrastructure as Code tools such as AWS CloudFormation or Terraform.

This would allow you to programmatically parametrize and generate the buckets and their policies in a reproducible and easy to manage manner.

user_2488230

You haven't mentioned how do you create the policy. But if you use IaC this is possible in both terraform and CloudFormation (I would assume that it's possible with other tools like cdk as well)

In CloudFormation you can use Ref and Fn:GetAtt.

And this is how it looks like in practice. Take a look at the examples section.

With terraform you can do something similar:

    {
        "Sid": "AllowSSLRequestsOnly",
        "Action": "s3:*",
        "Effect": "Deny",
        "Resource": [
            "arn:aws:s3:::${s3-bucket-name}",
            "arn:aws:s3:::${s3-bucket-name}/*"
        ],
        "Condition": {
            "Bool": {
                 "aws:SecureTransport": "false"
            }
        },
       "Principal": "*"
    }

And then pass the account_id (or in your case $bucket_name) from outside during the policy creation:

data "template_file" "s3-bucket-policy" {
  template = file("${path.module}/policies/bucket.json")

  vars = {
    s3-bucket-name   = aws_s3_bucket.my-bucket.bucket
  }
}
user_94056020

You can use jq to pipe and modify the bucket arn as a variable

user_64751330
Related