使用IAM用户正确配置（最佳）S3存储桶策略

Question

I'd have some experience with S3 bucket policies but recently I've started experimenting with IAM users/groups and S3 bucket ACLs. What bothers me is that I fail to understand how they work together. Who overwrites what? What I want to accomplish is to have specific IAM user (with credentials) that will be used as for uploading in my application. I've attached IAM Policy to it that looks like this:

{
    "Version": "2012-10-17",
    "Statement": [
    {
        "Effect": "Allow",
        "Action": [
            "s3:PutObject",
            "s3:GetObject",
            "s3:DeleteObject"
        ],
        "Resource": "arn:aws:s3:::*"
    }
    ]
}

This policy is attached to the IAM user. Then I've created following policy on S3 Bucket:

{
    "Version": "2012-10-17",
    "Statement": [
    {
        "Sid": "DefaultPrivate",
        "Effect": "Deny",
        "Principal": "*",
        "Action": "*",
        "Resource": "arn:aws:s3:::xxxxx-xxxxxx-xxxx/*"
    },
    {
        "Sid": "ThumbnailAndGaleryReadOnly",
        "Effect": "Allow",
        "Principal": "*",
        "Action": "s3:GetObject",
        "Resource": [ 
            "arn:aws:s3:::xxxx-xxx-xxxx-xxxx/*/xxxxx/*",
            "arn:aws:s3:::xxxxx-xxxxx-xxxxx/*/xxxxxxx/*"
        ]
    },
    {
        "Sid": "S3UploaderWrite",
        "Effect": "Allow",
        "Principal": {"AWS":"arn:aws:iam::xxxxxxxxxx:user/xxxxxxxx"},
        "Action": [
            "s3:GetObject",
            "s3:PutObject",
            "s3:DeleteObject"
        ],
        "Resource": "arn:aws:s3:::xxxxxxxxxxxx/*"
    }
    ]
}

Unfortunately as long as "Deny" block is present in the S3 policy - it doesn't allow my S3 user to upload files. Is it possible that I can't "override" Deny for specific user with the "Allow" block (IAM identifier is ok - I've double checked). Removing "Deny" blocks get it to work but ... That's not the point.

Any comments about the issue? How to explicitly deny everything and then allow only certain actions for certain IAM users/groups/roles ?

Thanks.

Answer 1

U could remove deny principal *. U could specify ur denied user or roles like "Principal": {"AWS":"arn:aws:iam::xxxxxxxxxx:user/xxxxxxxx"}. Its solve ur problem.