Home / server / Questions / 909488
Accepted
neubert
Asked: 2018-04-26 14:08:10 +0800 CST

creating a group that grants me full control over only one s3 bucket

  • 772

I want to create a user with a custom group that only lets me access one S3 bucket and I'm having difficulty doing so.

So I'm at this screen:

enter image description here

I've allowed S3 actions. Now I want to restrict it to just a specific bucket. I click on the "Resources" text and I get this:

enter image description here

I click on "Add ARN" for both and get this:

enter image description here

I use "whatever" as the "Bucket name" for bucket and "whatever" as the "Bucket name" for object (whilst leaving "Object name" blank) and then when I try to use the newly created account, in the newly created group, to access S3, I find that I can't upload or download files from the bucket without getting a 403 Forbidden error. If I use "All resources" instead of "Specific" it works but I only want this user to have access to one particular bucket.

Any ideas?

amazon-web-services

2 Answers

  1. Best Answer

    It looks like you're missing the wildcard * in the object declaration.

    It should be bucket-name/* instead of bucket-name/ when declaring bucket objects

    Try adding wildcard

    For the resulting entries:

    Try adding the wildcard

    • 2

  2. You haven't shared the actual policy, just screenshots of the wizard. If you want help with your policy please edit your post to include it.

    There are plenty of resources online to help with this, such as this AWS blog post, and this documentation.

    I have this policy which allows read only access to a single bucket. I attach the policy to a group, and add users who need that policy to that group. If you need different permissions just add them to the json.

    {
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": "s3:ListAllMyBuckets",
            "Resource": "arn:aws:s3:::*"
        },
        {
            "Sid": "Stmt1498596902003",
            "Effect": "Allow",
            "Action": [
                "s3:AbortMultipartUpload",
                "s3:GetObject",
                "s3:GetObjectVersion",
                "s3:GetObjectVersionAcl",
                "s3:ListAllMyBuckets",
                "s3:ListBucket",
                "s3:ListBucketMultipartUploads",
                "s3:ListBucketVersions",
                "s3:ListMultipartUploadParts"
            ],
            "Resource": [
                "arn:aws:s3:::bucket-name",
                "arn:aws:s3:::bucket-name/*"
            ]
        }
    ]
}
    • 1