Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I want to be able to allow users created through IAM to be able to view one bucket in the management console. Furthermore, I want to restrict it to a folder within the bucket, such that the permissions would be:

S3 Console access for my-bucket/folder/*

How would I do this using the policy generator? I currently have:

{
  "Statement": [
    {
      "Effect": "Allow",
      "Action": "s3:*",
      "Resource": "*"
    }
  ]
}

However, when I modify the Resource location -- arn:aws:s3:::my-bucket/folder -- it prevents the user from being able to use the console at all. Is this possible to do and what do I need to do to be able to fix this?

share|improve this question
add comment

1 Answer

You need to use conditions rather than adding the folder string to the resource, something like this...

"Resource":"arn:aws:s3:::mybucket"
"Condition":{
    "StringLike":{
            "s3:prefix":"folder/*"
    }
}
share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.