I have an Amazon S3 bucket which contains business sensitive documents and images. I would like to be able to grant all actions and permissions to the root AWS user and another user that I have created. However, I want to restrict all access to anyone else, including getting objects by anonymous users.

I am able to use the created user's access keys to create objects in the bucket but it seems that these objects are viewable to anyone. For example, a GET request from an incognito browser session to an image object will get a 200 and not a 403 as expected.

Below is the bucket policy I am using, with sensitive details changed.

    "Version": "2016-10-17",
    "Id": "Policy1487090751111",
    "Statement": [
            "Sid": "Stmt1487090741111",
            "Effect": "Allow",
            "Principal": {
                "AWS": [
            "Action": "s3:*",
            "Resource": [
  • 1
    Check the object ACLs. An object can be public-read. If you click on the object link in the console, then the Properties tab, you'll see that Everyone has Object access set to Read. If this is true, then the object can be downloaded by anyone unless this is changed or there is a Deny in the bucket policy. – Michael - sqlbot Apr 1 '17 at 18:57
  • Was that the issue? – Michael - sqlbot Apr 1 '17 at 23:36
  • I'm unsure at this moment but I think it very likely. – Jamie Hollern Apr 6 '17 at 9:26

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.