2

I've got an AWS S3 bucket where the only permissions I've defined are for myself and Amazon's Log Delivery. As shown from the AWS Console:

aws s3 bucket perms 1

As shown from another tool (S3 Browser):

aws s3 bucket perms 2

There's no public or everyone or anonymous users in the ACL.

Yet, public/anonymous users can read objects from the bucket:

public access

How can this be?

1 Answer 1

8

S3 has three ways to control access:

  • IAM
  • Bucket Policy
  • ACLs

I suspect you have a bucket policy that provides public access.

A bucket policy like this, which you haven't mentioned, would provide public access.

{
  "Version": "2012-10-17",
  "Statement": [
      {
          "Sid": "AddPerm",
          "Effect": "Allow",
          "Principal": "*",
          "Action": "s3:GetObject",
          "Resource": "arn:aws:s3:::BUCKETNAME/*"
      }
  ]
}
2
  • Yup. I incorrectly assumed that the console and other tools would show me the full set of permissions regardless of where they came from...
    – Howiecamp
    Commented Apr 9, 2017 at 21:44
  • 1
    Nope. S3 is the most confusing of the main AWS products with regards to security. I suspect it's partly due to legacy backwards compatibility.
    – Tim
    Commented Apr 9, 2017 at 22:12

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .