使用Amazon IAM限制用户访问Single S3存储桶？

Question

When you work with the team, you might want to restrict an access to a single S3 bucket to specific users. How can I achieve this?

The following code is not working. The user still has full permission.

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": "s3:ListAllMyBuckets",
            "Resource": "arn:aws:s3:::*"
        },
        {
            "Effect": "Allow",
            "Action": "s3:*",
            "Resource": [
                "arn:aws:s3:::Privatebacket",
                "arn:aws:s3:::Privatebacket/*"
            ]
        }
    ]
}

Answer 1

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                        "s3:GetBucketLocation",
                        "s3:ListAllMyBuckets"
                      ],
            "Resource": "arn:aws:s3:::*"
        },
        {
            "Effect": "Allow",
            "Action": "s3:*",
            "Resource": [
                "arn:aws:s3:::YOUR-BUCKET",
                "arn:aws:s3:::YOUR-BUCKET/*"
            ]
        }
    ]
}

https://www.serverkaka.com/2018/05/grant-access-to-only-one-s3-bucket-to-aws-user.html

Answer 2

Try the below mentioned link. You can grant user specific folder permissions using IAM policies.

https://aws.amazon.com/blogs/security/writing-iam-policies-grant-access-to-user-specific-folders-in-an-amazon-s3-bucket/

Answer 3

You can add an inline policy for that IAM user. You can set a 'deny' policy to that specific s3 bucket.

Policy Document:

{
"Version": "2012-10-17",
"Statement": [
    {
        "Sid": "Stmt1497522841000",
        "Effect": "Deny",
        "Action": [
            "s3:*"
        ],
        "Resource": [
            "arn:aws:s3:::mjzone-private"
        ]
    }
]
}