Home / server / Questions / 321027
In Process
David542
Asked: 2011-10-13 17:15:53 +0800 CST

Restricting console permissions in IAM for S3

  • 772

I want to be able to allow users created through IAM to be able to view one bucket in the management console. Furthermore, I want to restrict it to a folder within the bucket, such that the permissions would be:

S3 Console access for my-bucket/folder/*

How would I do this using the policy generator? I currently have:

{
  "Statement": [
    {
      "Effect": "Allow",
      "Action": "s3:*",
      "Resource": "*"
    }
  ]
}

However, when I modify the Resource location -- arn:aws:s3:::my-bucket/folder -- it prevents the user from being able to use the console at all. Is this possible to do and what do I need to do to be able to fix this?

amazon-s3

1 Answers

  1. You need to use conditions rather than adding the folder string to the resource, something like this...

    "Resource":"arn:aws:s3:::mybucket"
"Condition":{
    "StringLike":{
            "s3:prefix":"folder/*"
    }
}
    • 1