0

I have an Amazon S3 bucket which contains business sensitive documents and images. I would like to be able to grant all actions and permissions to the root AWS user and another user that I have created. However, I want to restrict all access to anyone else, including getting objects by anonymous users.

I am able to use the created user's access keys to create objects in the bucket but it seems that these objects are viewable to anyone. For example, a GET request from an incognito browser session to an image object will get a 200 and not a 403 as expected.

Below is the bucket policy I am using, with sensitive details changed.

{
    "Version": "2016-10-17",
    "Id": "Policy1487090751111",
    "Statement": [
        {
            "Sid": "Stmt1487090741111",
            "Effect": "Allow",
            "Principal": {
                "AWS": [
                    "arn:aws:iam::123456789876:root",
                    "arn:aws:iam::123456789876:user/my_user"
                ]
            },
            "Action": "s3:*",
            "Resource": [
                "arn:aws:s3:::my_bucket",
                "arn:aws:s3:::my_bucket/*"
            ]
        }
    ]
}
3
  • 1
    Check the object ACLs. An object can be public-read. If you click on the object link in the console, then the Properties tab, you'll see that Everyone has Object access set to Read. If this is true, then the object can be downloaded by anyone unless this is changed or there is a Deny in the bucket policy. Apr 1, 2017 at 18:57
  • Was that the issue? Apr 1, 2017 at 23:36
  • I'm unsure at this moment but I think it very likely. Apr 6, 2017 at 9:26

0

You must log in to answer this question.

Browse other questions tagged .