Protecting AWS resources based on Tags

user_7545591 0
Viewed 587

I'm trying to protect my AWS resources through a tag (without values)

Below is the example snippet of the IAM policy that I am using.

This doesn't seem to work!

        {
            "Action": [
                "s3:DeleteObject"
            ],
            "Resource": "*",
            "Effect": "Deny",
            "Sid": "ProtectResource",
            "Condition": {
                "StringEquals": {
                    "aws:TagKeys": "ProtectionTag"
                }
            }
        }

If I change "StringEquals" to "ForAllValues:StringEquals", then it works but the protection stays even when the tag is removed.

Can you help me construct a condition that helps me protect the resource based on a tag alone. Optionally, I am fine with providing values if that is required to construct the condition.

Thanks.

amazon-iam amazon-web-services
2 Answers

There is very often a misunderstanding/misconception about the differences between aws:TagKeys, aws:RequestTag and aws:ResourceTag regarding when they apply and what they apply for.

aws:TagKeys (only tag names) and aws:RequestTag (tag name/value pairs) is used to control access to API actions that carry tags in the request itself such as for modifying tags on a resource, in order to specify which tags (in the request itself) can be used with such an API action.

On the other hand, aws:ResourceTag is used to authorize API actions depending on the tag already present on the resource itself. So, if you want to specify a policy with a permission and that permission should only apply for resources that have a specific tag, then use aws:ResourceTag as the condition.

Having said this, the particular action s3:DeleteObject does not currently support resource-based tag conditions. So even though you can tag S3 objects, you cannot currently authorize API actions based on those resource tags.

Similar answer: Deny DeleteObject with a specific tag value in S3 bucket

user_86231590

Sadly, you can't do this. DeleteObject does not support any conditions based on tags. The supported conditions keys are in the screenshot:

enter image description here

Some workarounds are enabling versioning in the bucket, or if the entire bucket is critical you can use MFA delete protection.

user_2488230
Related