Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I want to be able to allow users created through IAM to be able to view one bucket in the management console. Furthermore, I want to restrict it to a folder within the bucket, such that the permissions would be:

S3 Console access for my-bucket/folder/*

How would I do this using the policy generator? I currently have:

  "Statement": [
      "Effect": "Allow",
      "Action": "s3:*",
      "Resource": "*"

However, when I modify the Resource location -- arn:aws:s3:::my-bucket/folder -- it prevents the user from being able to use the console at all. Is this possible to do and what do I need to do to be able to fix this?

share|improve this question

You need to use conditions rather than adding the folder string to the resource, something like this...

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.