Amazon IAM权限将S3FullAccess权限限制为一个存储桶

Question

I am new to Amazon IAM permissions. I created a group, added some users and then added a Policy, the one I found that suited me the most is called AmazonS3FullAccess policy, but I want to grant the group full access permission only to one of my buckets, not to all of them, how can I do that?

Answer 1

I assume AmazonS3FullAccess looks like this:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": "s3:*",
      "Resource": "*"
    }
  ]
}

In IAM Policies, things like buckets are identified by the element " Resource ." You might notice the policy above specifies the resource as the wildcard character * . This means that the policy above applies to all S3 resources.

You can limit the policy to a single S3 bucket by specifying the ARN of the bucket you wish to use:

"Resource": "arn:aws:s3:::EXAMPLE-BUCKET-NAME"

Related:

• AWS Documentation - IAM Policy Elements Reference
• AWS Documentation - S3 Bucket ARN Syntax