创建单个 IAM 用户以仅访问特定的 S3 存储桶

Question

I have many S3 buckets in my AWS account. But now I created an IAM user and a new S3 bucket, I would like to give this user the ability to access the new S3 bucket using a client like CyberDuck.

I tried to create so many policies. But after that this user getting permission to list all my other buckets also. How can I give access to listing and writing access to a single S3 bucket?

Answer 1

First you create a Policy to allow access to a single S3 bucket (IAM -> Policies -> Create Policy). You can use AWS Policy Generator ( http://awspolicygen.s3.amazonaws.com/policygen.html ), it should look something like this:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "Stmt1528735049406",
      "Action": [
        "s3:DeleteObject",
        "s3:GetObject",
        "s3:HeadBucket",
        "s3:ListBucket",
        "s3:ListObjects",
        "s3:PutObject"
      ],
      "Effect": "Allow",
      "Resource": "arn:aws:s3:::YOURBUCKETNAME"
    }
  ]
}

Save the policy and note the name you gave to it, then go to IAM -> Users and select the desired user. In the permissions tab, click 'Add permissions', then select 'Attach existing policies directly' near the top. Find your policy by its name, tick its checkbox and complete the process.

Answer 2

Per this ( https://aws.amazon.com/blogs/security/writing-iam-policies-grant-access-to-user-specific-folders-in-an-amazon-s3-bucket/ )

they'll need to be able to at least list all the buckets. But other than that, this also provides an example policy, which I just used last night for my own account, so I can confirm that it works.

Update Okay, I've tested and confirmed using CyberDuck that the following policy (customized to your environment of course) will prevent users from viewing all root buckets, and only allow them access to the bucket you specify:

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "AllowAllInBucket",
            "Action": [
                "s3:*"
            ],
            "Effect": "Allow",
            "Resource": "arn:aws:s3:::bucket-for-single-user"
        }
    ]
}

Just make sure that when you specify the path in CyberDuck, that you enter it as: bucket-for-single-user.s3.amazonaws.com .

Also, only START unrestricted like that, just to make sure it's working for you (since access appears to be an issue). After that, apply restrictions , you know...least privilege and all.

Answer 3

According to Cyberduck Help / Howto / Amazon S3 , it supports directly entering the Bucket name, as <bucketname>.s3.amazonaws.com . If this is possible with the client you are using, you don't need s3:ListAllMyBuckets permissions.

Action s should be grouped by the Resource s that they can parse ( Conditions are also potentially different per Action ).

This IAM policy will allow full control of all the content (aka in the bucket ) without controlling of the S3 bucket subresources (aka of the bucket ):

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "BucketOperations",
            "Effect": "Allow",
            "Action": "s3:ListBucket*",
            "Resource": "arn:aws:s3:::<bucketname>"
        },
        {
            "Sid": "ObjectOperations",
            "Effect": "Allow",
            "Action": [
               "s3:AbortMultipartUpload",
               "s3:ListMultipartUploads",
               "s3:DeleteObject*",
               "s3:GetObject*",
               "s3:PutObject*"
            ],
            "Resource": "arn:aws:s3:::<bucketname>/*"
        },
        {
            "Sid": "DenyAllOthers",
            "Effect": "Deny",
            "Action": "s3:*",
            "NotResource": [
               "arn:aws:s3:::<bucketname>",
               "arn:aws:s3:::<bucketname>/*"
            ]
        }
    ] 
}

If you aren't specifically trying to lock the IAM user out of every possible public S3 bucket, you can leave the "DenyAllOthers" Sid off, without granting additional permissions to the users.

FYI, the AWS ReadOnlyAccess policy automatically gives s3:* to anything it's attached to. I recommend ViewOnlyAccess (which will unfortunately grant s3:ListAllMyBuckets without the DenyAllOthers ).

Answer 4

I have many S3 buckets in my AWS account. But now I created an IAM user and a new S3 bucket, I would like to give this user the ability to access the new S3 bucket using a client like CyberDuck.

I tried to create so many policies. But after that this user getting permission to list all my other buckets also. How can I give access to listing and writing access to a single S3 bucket?

Answer 5

Create my own policy and working for me. The IAM user can just list all bucket. But cant do anything on another bucket. The user can only get access to the specific bucket with reading, write, delete files privileges.

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "<EXAMPLE_SID>",
            "Effect": "Allow",
            "Action": "s3:ListBucket",
            "Resource": "arn:aws:s3:::<MYBUCKET>"
        },
        {
            "Sid": "<EXAMPLE_SID>",
            "Effect": "Allow",
            "Action": "s3:ListAllMyBuckets",
            "Resource": "*"
        },  {
            "Sid": "<EXAMPLE_SID>",
            "Effect": "Deny",
            "Action": "s3:ListBucket",
            "Resource": "arn:aws:s3:::<MYotherBUCKET>"
        },  {
            "Sid": "<EXAMPLE_SID>",
            "Effect": "Allow",
            "Action": [
                "s3:PutObject",
                "s3:GetObject",
                "s3:DeleteObject"
            ],
            "Resource": "arn:aws:s3:::<MYBUCKET>/*"
        }

    ] 
}

Then add this policy also to this user. This policy will restrict all type of operation to listed other s3 bucket.

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "<EXAMPLE_SID>",
            "Effect": "Deny",
            "Action": [
                "s3:PutAnalyticsConfiguration",
                "s3:GetObjectVersionTagging",
                "s3:CreateBucket",
                "s3:ReplicateObject",
                "s3:GetObjectAcl",
                "s3:DeleteBucketWebsite",
                "s3:PutLifecycleConfiguration",
                "s3:GetObjectVersionAcl",
                "s3:PutBucketAcl",
                "s3:PutObjectTagging",
                "s3:DeleteObject",
                "s3:GetIpConfiguration",
                "s3:DeleteObjectTagging",
                "s3:GetBucketWebsite",
                "s3:PutReplicationConfiguration",
                "s3:DeleteObjectVersionTagging",
                "s3:GetBucketNotification",
                "s3:PutBucketCORS",
                "s3:DeleteBucketPolicy",
                "s3:GetReplicationConfiguration",
                "s3:ListMultipartUploadParts",
                "s3:PutObject",
                "s3:GetObject",
                "s3:PutBucketNotification",
                "s3:PutBucketLogging",
                "s3:PutObjectVersionAcl",
                "s3:GetAnalyticsConfiguration",
                "s3:GetObjectVersionForReplication",
                "s3:GetLifecycleConfiguration",
                "s3:ListBucketByTags",
                "s3:GetInventoryConfiguration",
                "s3:GetBucketTagging",
                "s3:PutAccelerateConfiguration",
                "s3:DeleteObjectVersion",
                "s3:GetBucketLogging",
                "s3:ListBucketVersions",
                "s3:ReplicateTags",
                "s3:RestoreObject",
                "s3:GetAccelerateConfiguration",
                "s3:GetBucketPolicy",
                "s3:PutEncryptionConfiguration",
                "s3:GetEncryptionConfiguration",
                "s3:GetObjectVersionTorrent",
                "s3:AbortMultipartUpload",
                "s3:PutBucketTagging",
                "s3:GetBucketRequestPayment",
                "s3:GetObjectTagging",
                "s3:GetMetricsConfiguration",
                "s3:DeleteBucket",
                "s3:PutBucketVersioning",
                "s3:PutObjectAcl",
                "s3:ListBucketMultipartUploads",
                "s3:PutMetricsConfiguration",
                "s3:PutObjectVersionTagging",
                "s3:GetBucketVersioning",
                "s3:GetBucketAcl",
                "s3:PutInventoryConfiguration",
                "s3:PutIpConfiguration",
                "s3:GetObjectTorrent",
                "s3:ObjectOwnerOverrideToBucketOwner",
                "s3:PutBucketWebsite",
                "s3:PutBucketRequestPayment",
                "s3:GetBucketCORS",
                "s3:PutBucketPolicy",
                "s3:GetBucketLocation",
                "s3:ReplicateDelete",
                "s3:GetObjectVersion"
            ],
            "Resource": [
                "arn:aws:s3:::<MYotherBUCKET>/*",
                "arn:aws:s3:::<MYotherBUCKET>"
            ]
        }
    ]
}

Answer 6

I was recently able to get this to work using Amazon's documentation . The key for me was to point the IAM User to the specific bucket NOT the S3 console . Per the documentation, "Warning: After you change these permissions, the user gets an Access Denied error when they access the main Amazon S3 console . The main console link is similar to the following:

https://s3.console.aws.amazon.com/s3/home

Instead, the user must access the bucket using a direct console link to the bucket, similar to the following:

https://s3.console.aws.amazon.com/s3/buckets/awsexamplebucket/ "

My policy is below:

{
"Version": "2012-10-17",
"Statement": [
    {
        "Sid": "Stmt1589486662000",
        "Effect": "Allow",
        "Action": [
            "s3:*"
        ],
        "Resource": [
            "arn:aws:s3:::AWSEXAMPLEBUCKET",
            "arn:aws:s3:::AWSEXAMPLEBUCKET/*"
        ]
    }
]
}