How to set ARN as s3 policy resource AWS

user_1132822 0
Viewed 106

I have a bucket called "payroll-manager". I am able to put objects, etc using cognito authenticated users, I modified the role of my identity pool to have full access to s3 (I followed this example). So far so good.

Now I need to change my policy to allow users to only read, write, etc from their own folder. I google on how to do it and I found this example from AWS. I removed the full access to s3 policy from my cognito role and created a policy following this example, the problem is that I always get a forbidden message.

I opened the IAM policy simulator and I find out that I can not even set this simple policy because it always denies me the permission: enter image description here

If I change the resource to "*" it allows me: enter image description here

In this example (I only have 1 bucket). Shouldn't be the same to use the resource with * or with ARN?

What should I do to be able to define the policy like AWS? enter image description here

aws-policies amazon-cognito amazon-web-services amazon-s3
1 Answers

TLDR; what you are doing is the right way to go and it works, fix the test object.

You probably won't be able to emulate cognito's policy because you'd need to set cognito-identity in the simulator somehow.

All you're missing to get the simple policy to pass is set the object arn to match your bucket. You're restricting a policy to payroll-manager but you are testing with *

Try setting the object to arn::aws::s3:::payroll-manager/example.txt to check that the simple policy works

user_14892370
Related