2

I've got an AWS S3 bucket where the only permissions I've defined are for myself and Amazon's Log Delivery. As shown from the AWS Console:

aws s3 bucket perms 1

As shown from another tool (S3 Browser):

aws s3 bucket perms 2

There's no public or everyone or anonymous users in the ACL.

Yet, public/anonymous users can read objects from the bucket:

public access

How can this be?

8

S3 has three ways to control access:

  • IAM
  • Bucket Policy
  • ACLs

I suspect you have a bucket policy that provides public access.

A bucket policy like this, which you haven't mentioned, would provide public access.

{
  "Version": "2012-10-17",
  "Statement": [
      {
          "Sid": "AddPerm",
          "Effect": "Allow",
          "Principal": "*",
          "Action": "s3:GetObject",
          "Resource": "arn:aws:s3:::BUCKETNAME/*"
      }
  ]
}
2
  • Yup. I incorrectly assumed that the console and other tools would show me the full set of permissions regardless of where they came from...
    – Howiecamp
    Apr 9 '17 at 21:44
  • 1
    Nope. S3 is the most confusing of the main AWS products with regards to security. I suspect it's partly due to legacy backwards compatibility.
    – Tim
    Apr 9 '17 at 22:12

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.