I have an Amazon S3 bucket which contains business sensitive documents and images. I would like to be able to grant all actions and permissions to the root AWS user and another user that I have created. However, I want to restrict all access to anyone else, including getting objects by anonymous users.
I am able to use the created user's access keys to create objects in the bucket but it seems that these objects are viewable to anyone. For example, a GET request from an incognito browser session to an image object will get a 200 and not a 403 as expected.
Below is the bucket policy I am using, with sensitive details changed.
{
"Version": "2016-10-17",
"Id": "Policy1487090751111",
"Statement": [
{
"Sid": "Stmt1487090741111",
"Effect": "Allow",
"Principal": {
"AWS": [
"arn:aws:iam::123456789876:root",
"arn:aws:iam::123456789876:user/my_user"
]
},
"Action": "s3:*",
"Resource": [
"arn:aws:s3:::my_bucket",
"arn:aws:s3:::my_bucket/*"
]
}
]
}
public-read
. If you click on the object link in the console, then theProperties
tab, you'll see thatEveryone
hasObject access
set toRead
. If this is true, then the object can be downloaded by anyone unless this is changed or there is aDeny
in the bucket policy.