2

we use s3 bucket to share files between two companies. We created private S3 bucket and we have dedicated user for application which uses this bucket (using it's aws_key and aws_secret). We figured out that we don't have access to getObject, but we sucessfully PutObject to bucket.

Also I've created role with permissions to this bucket and assigned it to application_user, but it did not resolve the issue.

So main goal is to have read,list,put access from external account and internal IAM user to same S3 bucket. I will point that external company has access to it, right now with this policy. I don't have access to external aws account.

Below there is a resource policy for s3.

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "SharedS3Bucket",
            "Effect": "Allow",
            "Principal": {
                "AWS": [
                    "arn:aws:iam::199999999999:root",    <--- external account 
                    "arn:aws:iam::111111111111:user/application_user" <-- our application user
                ]
            },
            "Action": [
                "s3:ListBucket",
                "s3:GetBucketAcl",
                "s3:GetObject",
                "s3:GetObjectAcl",
                "s3:DeleteObject",
                "s3:PutObject"
            ],
            "Resource": [
                "arn:aws:s3:::shared-bucket",
                "arn:aws:s3:::shared-bucket/*"
            ]
        }
    ]
}
1

The S3 permissions are a little complicated because you have not only the Bucket permissions to worry about but also each Object that you upload has its own permissions.

Your Bucket Policy above permits both companies to upload objects, and it works as you can see. However when the external company uploads an object it's default permissions only allow reading by the creator, i.e. by the external company. Even if it's in your bucket by default you can't read it if it was uploaded by someone else. That's somewhat counter-intuitive.

The solution is to make sure that the uploaded Objects have ACL that permits reading by both accounts.

S3 Upload Dialog

You will also need to add s3:PutObjectAcl to your list of Bucket Policy permissions for this to work.

Similarly if you're uploading from the command line you can modify the object acl after upload with aws s3api put-object-acl.

Hope that helps :)

  • Thank you for your time and clear explanation. I appreciate it. This is exact answer for my question. Each object in s3 has own permissions and these permissions need to be granted even for bucket owner. – bmbbambus Sep 18 '20 at 12:03

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.