如何限制用户仅查看特定存储桶

Question

I have a set of users: user1 and user2. Ideally they should have access to read and write in their own buckets.

I want to give them console access so they can login and upload the data in S3 through drag and drop.

So I want to the ability of one user to view buckets of other users.

I am using the following IAM policy:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "s3:ListBucket",
        "s3:GetBucketLocation",
        "s3:ListBucketMultipartUploads"
      ],
      "Resource": "arn:aws:s3:::user1_bucket",
      "Condition": {}
    },
    {
      "Effect": "Allow",
      "Action": [
        "s3:AbortMultipartUpload",
        "s3:DeleteObject",
        "s3:DeleteObjectVersion",
        "s3:GetObject",
        "s3:GetObjectAcl",
        "s3:GetObjectVersion",
        "s3:GetObjectVersionAcl",
        "s3:PutObject",
        "s3:PutObjectAcl",
        "s3:PutObjectVersionAcl"
      ],
      "Resource": "arn:aws:s3:::user1_bucket/*",
      "Condition": {}
    }
  ]
}

But it does not show any bucket for the user. All the user can see is Access Denied . I tried to add principal in the policy:

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Principal": {"AWS": "arn:aws:iam::9xxxxxxxxxx:user/user1"},
            "Action": "s3:*",
            "Resource": [
                "arn:aws:s3:::user1_bucket"
            ]
        }
    ]
}

This gives an error.

This policy contains the following error: Has prohibited field Principal For more information about the IAM policy grammar, see AWS IAM Policies

What can I do?

Answer 1

There are two ways you can do this.

Bucket policies: You select who can access and control said bucket, by attaching a policy. Example for your case:

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "bucketAccess",
            "Effect": "Allow",
            "Principal": {
                "AWS": "arn:aws:iam::AWS-account-ID:user/user-name"
            },
            "Action": [
                "s3:GetObject",
                "s3:AbortMultipartUpload",
                "s3:DeleteObject",
                "s3:DeleteObjectVersion",
                "s3:GetObjectAcl",
                "s3:GetObjectVersion",
                "s3:GetObjectVersionAcl",
                "s3:PutObject",
                "s3:PutObjectAcl",
                "s3:PutObjectVersionAcl"
            ],
            "Resource": [
                "arn:aws:s3:::examplebucket/*"
            ]
        }
    ]
}

Source: Bucket Policy Examples - Amazon Simple Storage Service

Or you can give access through role policies , which I think is better. You almost had it, but you messed up at the end. Your policy should look something like this:

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "s3:ListAllMyBuckets"
            ],
            "Resource": "arn:aws:s3:::"
        },
        {
            "Effect": "Allow",
            "Action": [
                "s3:ListBucket",
                "s3:GetBucketLocation"
            ],
            "Resource": "arn:aws:s3:::examplebucket"
        },
        {
            "Effect": "Allow",
            "Action": [
                "s3:PutObject",
                "s3:PutObjectAcl",
                "s3:GetObject",
                "s3:GetObjectAcl",
                "s3:DeleteObject"
            ],
            "Resource": "arn:aws:s3:::examplebucket/"
        }
    ]
}

Source: User Policy Examples - Amazon Simple Storage Service

I hope this helps.

Answer 2

It appears that your requirement is:

• Users should be able to use the Amazon S3 management console to access (view, upload, download) their own S3 bucket
• They should not be able to view the names of other buckets, nor access those buckets

With listing buckets

The first requirement can be met with a policy like this:

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "AccessThisBucket",
            "Effect": "Allow",
            "Action": "s3:*",
            "Resource": [
                "arn:aws:s3:::my-bucket",
                "arn:aws:s3:::my-bucket/*"
            ]
        },
        {
            "Sid": "ListAllBucketForS3Console",
            "Effect": "Allow",
            "Action": "s3:ListAllMyBuckets",
            "Resource": "arn:aws:s3:::*"
        }
    ]
}

This allow them to access their specific bucket, but it also allows them to list all bucket names . This is a requirement of the Amazon S3 management console, since the first thing it does is list all of the buckets.

Without listing buckets

However, since you do not want to give these users the ability to list the names of all buckets, you could use a policy like this:

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "VisualEditor0",
            "Effect": "Allow",
            "Action": "s3:*",
            "Resource": [
                "arn:aws:s3:::my-bucket",
                "arn:aws:s3:::my-bucket/*"
            ]
        }
    ]
}

This gives them full access to their own bucket, but they cannot list the names of other buckets.

To use this in the management console, they will need to jump directly to their bucket using a URL like this:

https://console.aws.amazon.com/s3/buckets/my-bucket

This will then allow them to access and use their bucket.

They will also be able to use AWS Command-Line Interface (CLI) commands like:

aws s3 ls s3://my-bucket
aws s3 cp foo.txt s3://my-bucket/foo.txt

Bottom line: To use the management console without permission to list all buckets, they will need to use a URL that jumps straight to their bucket.