Does age of an IAM account affect object-level permissions in AWS S3?

user_10394944 0
Viewed 23

I am working with Terraform and cannot initialise the working directory. For context, the bucket and state file was made by someone who has since left the company.

I have granted myself permission to Write, List objects and Read, Write Bucket ACL. The debug log shows that I am able to ListObject from the bucket but I fail at GetObjectwith an AccessDenied error. Attempting to download the state file with AWS CLI returns the same error as expected. I am an admin and I am able to download the state file from the S3 console.

My co-worker who has the same permission set as me (admin) is able to download the state file via AWS CLI without issue and her IAM account was made before the terraform state bucket was made. Does the age of our IAM account affect access?

amazon-web-services amazon-s3
1 Answers

No, the age of an account does not affect in any way the permissions attached to it. You can't access the S3 bucket because either your role used by Terraform does not have the necessary permissions ore the bucket policy explicitly denies the access, but chances are you do not have the necessary permissions for the role itself.

In order for Terraform to be able to work with a remote state in S3, the following permissions are required (source):

  • s3:ListBucket on arn:aws:s3:::mybucket
  • s3:GetObject on arn:aws:s3:::mybucket/path/to/my/key
  • s3:PutObject on arn:aws:s3:::mybucket/path/to/my/key
  • s3:DeleteObject on arn:aws:s3:::mybucket/path/to/my/key
user_76611190
Related