如何将Cognito用户池用户减少到S3存储桶中自己的文件夹？

Question

I am writing a basic react native app where users will be able to register themselves to an AWS cognito userpool and log in with that identity to store/retrieve their data from S3. I only have one bucket and every user will have their own folder in that bucket. How can I restrict each user to their own folder in that case. Here is the scenario.

I created two users in the user pool.

I then created a federated identity for my userpool. This federated identity has two IAM roles, authorized and unauthorized.

I then added a policy to the auth role of federated identity.

Here is my policy:

 { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": "*", "Resource": "arn:aws:s3:::mybucket/${cognito-identity.amazonaws.com:sub}/*" } ] } 

I then tried to retrieve data from S3 using Javascript SDK and I could ListObjects from "album-b207a8df-58e8-49cf-ba1b-0b48b7252291" where "b207a8df-58e8-49cf-ba1b-0b48b7252291" is the sub of "madi" user. Why was "test2" able to list that object?

Answer 1

Can you provide a snippet of the onClick_Cognito_receiptsdumpAuth_Role.*** ??

---

My guess (without your logs)

1. is that your policy is probably good, but you might have a policy that grants list access to too much.

2. Your AWS class is being inited with your developer credentials (which might have full Admin)

3. Cognito might have an issue and its worth logging a support ticket.

---

Next steps I would try is

You might have a action:List* or equivalent

Also best hidden secret (it's not really a secret) is the policy simulator . Test your policy against that and it will tell you if at least the policy is good and don't forget that iam policies are concatenated.

Lastly, if you can't figure out how the access is provided to the List Operation, you can enable CloudTrail to dump API logs to S3 and verify that the listobjects is being run by the cognito user you are expecting.