S3存储桶访问

Question

I am trying to give single S3 bucket access to different user without listing all the buckets, Hence I didnot use list all my buckets policy. The buckets contains different folders inside folders, when I am trying to list the contents in the folder through its shows nothing

The policy I am using

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "ListBucket",
            "Effect": "Allow",
            "Principal": {
                "AWS": "arn:aws:iam::abcd”
            },
            "Action": "s3:ListBucket",
            "Resource": "arn:aws:s3:::abcd”
        },
        {
            "Sid": "AddDeleteFiles",
            "Effect": "Allow",
            "Principal": {
                "AWS": "arn:aws:iam::abcd”
            },
            "Action": [
                "s3:DeleteObject",
                "s3:GetObject",
                "s3:PutObject"
            ],
            "Resource": "arn:aws:s3:::abcd/*”
        }
    ]

}

output of s3cmd ls [s3://abcd/aa] -acess denied

Answer 1

Did you configure your s3cmd with the right aws_access_key_id and aws_secret_access_key ?

s3cmd --configure 

basically creates a ~/.s3cfg command with the right parameters.

Also on Principal you need to specify your account id. For example:

{
  "Version":"2012-10-17",
  "Statement":[
    {
      "Sid":"AddCannedAcl",
      "Effect":"Allow",
      "Principal": {"AWS": ["arn:aws:iam::111122223333:root","arn:aws:iam::444455556666:root"]},
      "Action":["s3:PutObject","s3:PutObjectAcl"],
      "Resource":["arn:aws:s3:::examplebucket/*"],
      "Condition":{"StringEquals":{"s3:x-amz-acl":["public-read"]}}
    }
  ]
}

You'll have to make sure what your are putting in a bucket policy or IAM policy, as they are not interchangeable. You can have both but you have to make sure each one is the correct for the type of policy

Hope it helps.