AWS S3 | 允许被授权者仅从存储桶下载对象

Question

It is possible to allow grantee to ONLY download objects from the AWS S3 bucket? They should not be able to upload any documents in the bucket. If it is possible what bucket permissions should we assign to grantee? I tried searching this over the web but couldn't find any relevant links. Thanks in advance!

Answer 1

You can use following URL to generate the required policy.

https://awspolicygen.s3.amazonaws.com/policygen.html

Select Type of Policy: S3 Bucket Policy

Effect: Check Allow

Principal: * (Which means for every one)

Actions: GetObject

Amazon Resource Name (ARN): ARN should follow the following format: arn:aws:s3:::<bucket_name>/<key_name>. Use a comma to separate multiple values.

Press Add statement and in step 3 you will be able to generate required policy.

Below is a sample policy.

{
  "Id": "PolicyID",
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "Stmt1610823452352355758",
      "Action": [
        "s3:GetObject"
      ],
      "Effect": "Allow",
      "Resource": "arn:aws:s3:::sample-resource-name/*",
      "Principal": "*"
    }
  ]
}