6

I have a list of buckets in AWS S3. I have created an IAM user. I have an option to provide S3 full or read only access for a user using groups. Is there any options to provide access only to a particular bucket?

  • Not sure about that. But, the other way round can definitely happen. I mean, a bucket accepting requests from only a particular user. Wouldn't that work for you? – Dawny33 Jul 30 '17 at 18:27
  • @Dawny33 I that case I need to create an IAM user with user name and password. Then I have to provide s3 bucket access for that user. Then that user has to create a key for accessing. Instead, I need to create a programmatic access user (which creates access keys for the user instead of username and password). I'm not able to provide permissions for such an IAM user. – Sathishkumar Jayaraj Jul 31 '17 at 5:00
  • Related: Restrict List of Buckets for a Specific User. – kenorb Sep 29 '17 at 13:36
7

Amazon's IAM roles generally grant a role access to a particular ARN (Amazon Resource Name). Amazon notes on their pages that for S3 a resource

...can be a bucket-name or a bucket-name/object-key.

They also provide a helpful example for doing just this which appears as follows:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": ["s3:ListBucket"],
      "Resource": ["arn:aws:s3:::test"]
    },
    {
      "Effect": "Allow",
      "Action": [
        "s3:PutObject",
        "s3:GetObject",
        "s3:DeleteObject"
      ],
      "Resource": ["arn:aws:s3:::test/*"]
    }
  ]
}
1

To provide access for specific bucket, you can define the following policy for that user or group:

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "s3:ListBucket",
                "s3:GetBucketLocation",
                "s3:ListBucketMultipartUploads"
            ],
            "Resource": [
                "arn:aws:s3:::my-bucket"
            ]
        },
        {
            "Effect": "Allow",
            "Action": [
                "s3:AbortMultipartUpload",
                "s3:DeleteObject",
                "s3:DeleteObjectVersion",
                "s3:GetObject",
                "s3:GetObjectAcl",
                "s3:GetObjectVersion",
                "s3:GetObjectVersionAcl",
                "s3:PutObject",
                "s3:PutObjectAcl",
                "s3:PutObjectVersionAcl"
            ],
            "Resource": [
                "arn:aws:s3:::my-bucket/*"
            ]
        },
        {
            "Effect": "Allow",
            "Action": [
                "s3:ListAllMyBuckets"
            ],
            "Resource": "arn:aws:s3:::*"
        }
    ]
}

Where my-bucket is your name of your bucket.

Then send them the Console URL for that bucket, e.g.

  • https://s3.console.aws.amazon.com/s3/buckets/BUCKET_NAME/

Related:

  • May worth noting your actual policy block actions on the bucket itself and allow control only to inner objects of the bucket. – Tensibai Oct 3 '17 at 11:53
1

Attach below policy to that user:

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                        "s3:GetBucketLocation",
                        "s3:ListAllMyBuckets"
                      ],
            "Resource": "arn:aws:s3:::*"
        },
        {
            "Effect": "Allow",
            "Action": "s3:*",
            "Resource": [
                "arn:aws:s3:::YOUR-BUCKET",
                "arn:aws:s3:::YOUR-BUCKET/*"
            ]
        }
    ]
}

https://www.serverkaka.com/2018/05/grant-access-to-only-one-s3-bucket-to-aws-user.html

0

Since you are looking for programmatic role creation you might consider IAM Roles for EC2. Those can be applied to EC2 instances without human intervention, and they also avoid the need to store many credentials/keys, which is always nice when using automation.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.