How can we allow iam user to only upload object and deny him to delete and list objects?

user_16295835 0
Viewed 212

I wanna create a S3 bucket that anyone can get object but only iam user can upload an object.

My bucket policy is like this. Anyone can read objects, but cannot do delete, list, create action.

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "PublicRead",
      "Effect": "Allow",
      "Principal": {
        "AWS": "*"
      },
      "Action": "s3:GetObject",
      "Resource": "*"
    }
  ]
}

I attached the below policy for a permission to upload object to a user and the group.

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "Stmt1347416638923",
      "Effect": "Allow",
      "Action": "s3:PutObject",
      "Resource": "arn:aws:s3:::my_bucket/*" //fixed as @Marcin mentioned

    }
  ]
}

The problem is that this user can list objects, delete object from javascript. How can we allow this user to only upload object?

We use Wasabi storage by the way.

amazon-web-services amazon-s3
1 Answers

arn:aws:s3:::my_bucket is a bucket, not objects. Thus it should be:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "Stmt1347416638923",
      "Effect": "Allow",
      "Action": "s3:PutObject",
      "Resource": "arn:aws:s3:::my_bucket/*"
    },
    {
      "Sid": "ExplityDeny",
      "Effect": "Deny",
      "Action": "s3:DeleteObject",
      "Resource": "arn:aws:s3:::my_bucket/*"
    },
    {
      "Sid": "ExplityDeny2",
      "Effect": "Deny",
      "Action": "s3:ListBucket",
      "Resource": "arn:aws:s3:::my_bucket"
    }
  ]
}
user_2488230
Related