AWS - Permission Denied After Setting a Policy with SecureTransport:false

user_3501205 0
Viewed 617

I was trying to enforce a policy that allows only SSL access.
However, after attaching the Policy, now I get "You don't have permissions" on every single thing in this bucket, including the Permissions tab and Bucket Policy section.
I am the admin and I do have all access permissions to S3 in IAM for my user.

This is the policy:

{
"Id": "Policy98421321896",
"Version": "2012-10-17",
"Statement": [
    {
    "Sid": "MustBeEncryptedInTransit",
    "Action": "s3:*",
    "Effect": "Deny",
    "Resource": [
        "arn:aws:s3:::cf-templates-98d9d7a96z21x-us-east-1",
        "arn:aws:s3:::cf-templates-98d9d7a96z21x-us-east-1/*"
        ],
    "Condition": {
        "ArnEqualsIfExists": {
        "aws:SecureTransport": "false"
        }
    },
    "Principal": "*"
    }
]
}

Question is:
How do I restore permissions to this bucket?
And how should I correctly set this policy?

amazon-web-services amazon-s3
1 Answers

When you want to add a condition which checks for Boolean values then it should be "Bool" key with valid value.

"Condition": {
    "Bool": {
      "aws:SecureTransport": "true"
    }
  }

What you are trying to achieve is mentioned in this blog and you can use it according to your need.

https://aws.amazon.com/premiumsupport/knowledge-center/s3-bucket-policy-for-config-rule/

{
  "Id": "ExamplePolicy",
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "AllowSSLRequestsOnly",
      "Action": "s3:*",
      "Effect": "Deny",
      "Resource": [
        "arn:aws:s3:::DOC-EXAMPLE-BUCKET",
        "arn:aws:s3:::DOC-EXAMPLE-BUCKET/*"
      ],
      "Condition": {
        "Bool": {
          "aws:SecureTransport": "false"
        }
      },
      "Principal": "*"
    }
  ]
}

About your 2nd part of the question, you can reset the permission using your root account as it should have god level permissions. But it is strange that updating a bucket policy changes your IAM policies and you can't access certain parts of S3 config. Maybe something else is missing here..

user_9704220
Related