5

I have a bucket with several files publicly downloadable. I want to put up a bucket policy after which these files should only be downloadable by my IAM users. The policy I have got so far is this:

{
    "Version": "2008-10-17",
    "Id": "Policy1424952346041",
    "Statement": [
        {
            "Sid": "Stmt1424958477350",
            "Effect": "Deny",
            "NotPrincipal": {
                "AWS": "arn:aws:iam::777777777777:root"
            },
            "Action": "s3:*",
            "Resource": "arn:aws:s3:::test/*"
        },
        {
            "Sid": "Stmt1424958477351",
            "Effect": "Allow",
            "Principal": {
                "AWS": "arn:aws:iam::777777777777:root"
            },
            "Action": "s3:*",
            "Resource": "arn:aws:s3:::test/*"
        }
    ]
}

However, it is denying everyone including the IAM users. Can anyone please point out what is wrong here?

  • How are the IAM users accessing/authenticating? – ceejayoz Feb 26 '15 at 14:34
  • web console or s3curl – Aditya Patawari Feb 26 '15 at 14:36
  • Try giving them access to "Resource": "arn:aws:s3:::test" as well as "Resource": "arn:aws:s3:::test/*" then so they can list the contents of the bucket. – ceejayoz Feb 26 '15 at 15:12
  • @ceejayoz, nope. that does not help. – Aditya Patawari Feb 26 '15 at 15:15
2

Depending on how many IAM users you have in the account, you can specify the accounts in both statements as follows (try one or two just as a test to see if it works). I've had issues in the past with getting arn:aws:iam::XXXXXXXXXXXX:root to actually cover all IAM accounts. You could also try just specifying the IAM users and remove the root entry.

{
    "Version": "2008-10-17",
    "Id": "Policy1424952346041",
    "Statement": [
        {
            "Sid": "Stmt1424958477350",
            "Effect": "Deny",
            "NotPrincipal": {
                "AWS": [
                        "arn:aws:iam::777777777777:root",
                        "arn:aws:iam::777777777777:user/user1", 
                        "arn:aws:iam::777777777777:user/user2" ]
            },
            "Action": "s3:*",
            "Resource": "arn:aws:s3:::test/*"
        },
        {
            "Sid": "Stmt1424958477351",
            "Effect": "Allow",
            "Principal": {
                "AWS": [
                        "arn:aws:iam::777777777777:root",
                        "arn:aws:iam::777777777777:user/user1",
                        "arn:aws:iam::777777777777:user/user2" ]
            },
            "Action": "s3:*",
            "Resource": "arn:aws:s3:::test/*"
        }
    ]
}
| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.