AWS , iOS, cognito, confusion

Question

I am working on an app that loads files into s3, following this example

https://github.com/awslabs/aws-sdk-ios-samples/tree/master/S3BackgroundTransfer-Sample/Objective-C

In the read me it says

In the Amazon Cognito console, use Amazon Cognito to create a new identity 
pool. Obtain the PoolID constant. Make sure the role has full permissions for 
the bucket you created.

This is confusing for me, When I go to IAM roles, And to manage users, I see I can add AmazonS3FullAccess Policy, but I cannot specify the actual bucket name !! When clicking on show policy I get this pop up

{
 "Version": "2012-10-17",
 "Statement": [
   {
    "Effect": "Allow",
    "Action": "s3:*",
    "Resource": "*"
   }
 ]
}

and its read only . I have an s3 bucket and want to make sure the IAM user can access it but can't figure out how to do that on the AWS website.

Answer 1

ok after digging around, I found the way to create a custom policy and update the s3 bucket in it and attach it to a role. in IAM, under dashboard go to policies -> create policy -> Copy an AWS Managed Policy ( I recommend ) and form there you configure it. Hope this helps others, still think the site needs to be better documented.

Answer 2

The pre-configure AmazonS3FullAccess policy gives full access to Amazon S3, hence there is no restriction on bucket name.

Here is an example of policy that restrict to a specific bucket and "directory" in S3 only if the directory name match the user's Cognito user ID.

You restrict access to a specific Bucket / Directory / File by using the Resource section of the policy.

{
         "Effect": "Allow",
         "Action": [
            "s3:PutObject",
            "s3:GetObject",
            "s3:DeleteObject"
         ],
         "Resource": [
            "arn:aws:s3:::iosdemo-upload/pictures/${cognito-identity.amazonaws.com:sub}/*"
         ]
      }

To discover more about Amazon S3 policies, I would suggest you to walk through these steps http://docs.aws.amazon.com/AmazonS3/latest/dev/walkthrough1.html