2

I've got an AWS S3 bucket where the only permissions I've defined are for myself and Amazon's Log Delivery. As shown from the AWS Console:

aws s3 bucket perms 1

As shown from another tool (S3 Browser):

aws s3 bucket perms 2

There's no public or everyone or anonymous users in the ACL.

Yet, public/anonymous users can read objects from the bucket:

public access

How can this be?

8

S3 has three ways to control access:

  • IAM
  • Bucket Policy
  • ACLs

I suspect you have a bucket policy that provides public access.

A bucket policy like this, which you haven't mentioned, would provide public access.

{
  "Version": "2012-10-17",
  "Statement": [
      {
          "Sid": "AddPerm",
          "Effect": "Allow",
          "Principal": "*",
          "Action": "s3:GetObject",
          "Resource": "arn:aws:s3:::BUCKETNAME/*"
      }
  ]
}
  • Yup. I incorrectly assumed that the console and other tools would show me the full set of permissions regardless of where they came from... – Howiecamp Apr 9 '17 at 21:44
  • 1
    Nope. S3 is the most confusing of the main AWS products with regards to security. I suspect it's partly due to legacy backwards compatibility. – Tim Apr 9 '17 at 22:12

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.