How can I know which AWS S3 bucket(s) an AWS key and secret key that can access?

Question

I have an AWS key and secret key that can access some AWS S3 buckets. How can I know which ones?

Answer 1

This is a good question and I don't think there is a single, particularly simple answer.

If all you've got is an access key and secret key, you may want to use aws cli commands like list-buckets. Given the volume of different IAM permissions for S3 and what exactly you are looking for this may or may not be a feasible approach. S3 ACLs add further complexity.

If you have access to AWS UI as well, assuming you have sufficient permissions, you could analyze IAM policies to find out the effective permissions you've been granted. IAM Access Analyzer for S3 is also an option.

Answer 2

If you need to do this programmatically, say if you have a lot of credentials or buckets this bit of Python I wrote a while ago might help:

import botocore
import boto3
import os
from pathlib import Path
import configparser

#-----------------------------------------------------------------------------------------
# Check credentials and return resource & session
#-----------------------------------------------------------------------------------------
def Establish_Connection():
#-----------------------------------------------------------------------------------------
# Check credentials environment variable
#-----------------------------------------------------------------------------------------
    try:
        Env_Variable = os.environ['AWS_SHARED_CREDENTIALS_FILE']
    except:
        print("The environment variable AWS_SHARED_CREDENTIALS_FILE is not set.")
        return None, None
    
#-----------------------------------------------------------------------------------------
# Check credentials file
#-----------------------------------------------------------------------------------------
    Credential_File_Path = Path( Env_Variable )
    try:
        Absolute_File_Path = Credential_File_Path.resolve(strict=True)
    except FileNotFoundError:
        print("The file named by the environment variable,", Credential_File_Path, "cannot be resolved to an absolute path.")
        return None, None

    if not Absolute_File_Path.is_file():
        print("The resolved file name,", Absolute_File_Path, "cannot be found.")
        return None, None

#-----------------------------------------------------------------------------------------
# Check what profiles are present in the credentials file
#-----------------------------------------------------------------------------------------
    Cred_Config = configparser.ConfigParser()

    try:
        Cred_Config.read(Absolute_File_Path)
    except Exception as err:
        print("Exception reading credentials file {}".format(err))
        return None, None

    Profile = "s3_user"
    # Check the profiles present in the credentials file:
    if not Cred_Config.has_section(Profile):
        print("Credentials for s3_user profile not found in the configuration file.")
        Profile = "default"
        if not Cred_Config.has_section(Profile):
            print("Credentials for default profile not found in the configuration file.")
            return None, None
    
#-----------------------------------------------------------------------------------------
# Try to set up the AWS session and resource objects
#-----------------------------------------------------------------------------------------
    try:
        S3_Session = boto3.Session(profile_name=Profile)
    except botocore.exceptions.ProfileNotFound :
        print("Could not establish AWS session using", Profile, " credentials.")
        return None, None

    # Create the S3 resource object
    try:
        S3_Resource = S3_Session.resource('s3')    
    except Exception as e:
        print("Can't create S3 resource object {}", e)
        return None, None

    # Create the S3 client object
    try:
        S3_Client = S3_Session.client('s3')    
    except Exception as e:
        print("Can't create S3 client object {}", e)
        return None, None

    return S3_Resource, S3_Client

#-----------------------------------------------------------------------------------------
# Extract bucket information
#-----------------------------------------------------------------------------------------
def Extract_Basics(Bucket, Location_Response ):
    Name = Bucket.name

    Bucket_Information = {
        'Name'          : Name,
        'Location'      : Location_Response['LocationConstraint'],
        'Website'       : {
                            'isWebsite' : False,
                            'Index'     : '',
                            'Error'     : ''
                        },
        'Directories'   : -1,
        'Files'         : -1,
        'Volume'        : -1,
        'Tags'          : {},
        'Storage_Class' : {},
        'Owner'         : {},
        'File_Types'    : {},
        'Age_Count'     : [],
        'Age_Count_Size': [],
        'Age_Volume'    : []
    }
    return Bucket_Information

#====================================================================================================
# Main function
#====================================================================================================
def main():
#-----------------------------------------------------------------------------------------
# Check credentials environment variable
#-----------------------------------------------------------------------------------------
    S3_Resource, S3_Client = Establish_Connection()
    if S3_Resource == None:
        return

#-----------------------------------------------------------------------------------------
# List buckets
#-----------------------------------------------------------------------------------------
    Bucket_List = []
    Bucket_Information = {}

    try:
        Buckets = list(S3_Resource.buckets.all())
    except Exception as e:
        print("Could not list buckets ", e )
        return

    for Bucket in Buckets:
        Name = Bucket.name

        Location_Response =  S3_Client.get_bucket_location(Bucket=Name)
        Bucket_Information = Extract_Basics( Bucket, Location_Response )

        Bucket_List.append( Bucket_Information )
    
    print("Bucket list of info")
    print( Bucket_List )
    return

if __name__ == '__main__':
    main()