Why bucket policy does not provide IAM user to list s3 buckets even bucket policy is set for the user?

Question

I have created bucket poc-work from admin account, and under this policy I have set policy like below:

{
    "Version": "2012-10-17",
    "Id": "Policy1620674317608",
    "Statement": [
        {
            "Sid": "Stmt1321974214233",
            "Effect": "Allow",
            "Principal": {
                "AWS": "arn:aws:iam::accound-id:user/iam-user"
            },
            "Action": "s3:*",
            "Resource": [
                "arn:aws:s3:::poc-work",
                "arn:aws:s3:::poc-work/*"
            ]
        }
    ]
}

I have not attached any aws managed policy like s3readonly to IAM user, but I am under assumption that setting bucket policy should make bucket visible to IAM user. But when IAM user log in and check for s3 service there is error message: You don't have permissions to list buckets

I have below queries:

1. can't I create bucket policy that enables list s3 buckets?
2. Is it necessary to attach policy already defined browsing on IAM console and then rest of operations control with bucket policy?

Answer 1

You are giving the user permission for one bucket, but if the user is going through the console the user needs the ListAllBuckets permission to see all the buckets that exist in the account. So you do need to add permissions to the IAM user as well--not just the one bucket.

Also see:

• https://acloud.guru/forums/s3-masterclass/discussion/-L6X96Lo37ZnG_g6wiEg/ListBucket%20vs%20ListAllMyBuckets
• https://stackoverflow.com/a/30961920/230055
• https://docs.aws.amazon.com/AmazonS3/latest/userguide/using-with-s3-actions.html#using-with-s3-actions-related-to-buckets
• https://docs.aws.amazon.com/AmazonS3/latest/userguide/example-walkthroughs-managing-access-example1.html

The 1st link says:

ListAllMyBuckets is required for seeing the list of buckets via the AWS console. It is a MUST if you plan to use the console for S3 administration. If you don't have this permission you basically won't see any of the buckets in the S3 console despite whatever other permissions you have configured and therefore can't take any action upon them.