How to make different permissions for different subdirectories of storage bucket

Question

On Google Cloud Storage or Amazon S3, is there a way to give users a key to only a specific subdirectory of a storage bucket, for example:

gs://images.eng.cm.com/avatars/<user-uuid>/xyz

so the user has a user id of and they can read and write only to that subdirectory of the storage bucket, and only if they have a read/write access key in hand too?

Anyone know how to create this fine-grained access control? is it possible/advised?

Answer 1

Before giving the answer I'd like to clarify that S3 is meant for object storage, meaning that there's no file system involved and thus there are not "directories" per se.

So, an "object" with the name "/avatars/user-123/xyz" might give you the impression that it's stored in the "/avatars/user-123" directory, but there's no directory involved, that's just a name.

That being said, you can treat that portion of the name (/avatars/user-123) as a prefix, and then you can create IAM policies for your S3 buckets using said prefixes.

For futre reference, the following examples have been taken from: https://aws.amazon.com/premiumsupport/knowledge-center/s3-folder-user-access/

In case readers find out that link has been taken down I'll just copy and paste the examples here

AllowStatement1 allows the user to list the buckets that belong to their AWS account. The user needs this permission to be able to navigate to the bucket using the console.

AllowStatement2A allows the user to list the folders within awsexamplebucket, which the user needs to be able to navigate to the folder using the console. The statement also allows the user to search on the prefix media/ using the console.

AllowStatement3 allows the user to list the contents within awsexamplebucket/media.

AllowStatement4A allows the user to download objects (s3:GetObject) from the folder awsexamplebucket/media.

{
 "Version":"2012-10-17",
 "Statement": [
   {
     "Sid": "AllowStatement1",
     "Action": ["s3:ListAllMyBuckets", "s3:GetBucketLocation"],
     "Effect": "Allow",
     "Resource": ["arn:aws:s3:::*"]
   },
  {
     "Sid": "AllowStatement2A",
     "Action": ["s3:ListBucket"],
     "Effect": "Allow",
     "Resource": ["arn:aws:s3:::awsexamplebucket"],
     "Condition":{"StringEquals":{"s3:prefix":["","media"]}}
    },
  {
     "Sid": "AllowStatement3",
     "Action": ["s3:ListBucket"],
     "Effect": "Allow",
     "Resource": ["arn:aws:s3:::awsexamplebucket"],
     "Condition":{"StringLike":{"s3:prefix":["media/*"]}}
    },    
   {
     "Sid": "AllowStatement4A",
     "Effect": "Allow",
     "Action": ["s3:GetObject"],
     "Resource": ["arn:aws:s3:::awsexamplebucket/media/*"]
   }
 ]
}