0

I want to create a user with a custom group that only lets me access one S3 bucket and I'm having difficulty doing so.

So I'm at this screen:

enter image description here

I've allowed S3 actions. Now I want to restrict it to just a specific bucket. I click on the "Resources" text and I get this:

enter image description here

I click on "Add ARN" for both and get this:

enter image description here

I use "whatever" as the "Bucket name" for bucket and "whatever" as the "Bucket name" for object (whilst leaving "Object name" blank) and then when I try to use the newly created account, in the newly created group, to access S3, I find that I can't upload or download files from the bucket without getting a 403 Forbidden error. If I use "All resources" instead of "Specific" it works but I only want this user to have access to one particular bucket.

Any ideas?

2

It looks like you're missing the wildcard * in the object declaration.

It should be bucket-name/* instead of bucket-name/ when declaring bucket objects

Try adding wildcard

For the resulting entries:

Try adding the wildcard

| improve this answer | |
1

You haven't shared the actual policy, just screenshots of the wizard. If you want help with your policy please edit your post to include it.

There are plenty of resources online to help with this, such as this AWS blog post, and this documentation.

I have this policy which allows read only access to a single bucket. I attach the policy to a group, and add users who need that policy to that group. If you need different permissions just add them to the json.

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": "s3:ListAllMyBuckets",
            "Resource": "arn:aws:s3:::*"
        },
        {
            "Sid": "Stmt1498596902003",
            "Effect": "Allow",
            "Action": [
                "s3:AbortMultipartUpload",
                "s3:GetObject",
                "s3:GetObjectVersion",
                "s3:GetObjectVersionAcl",
                "s3:ListAllMyBuckets",
                "s3:ListBucket",
                "s3:ListBucketMultipartUploads",
                "s3:ListBucketVersions",
                "s3:ListMultipartUploadParts"
            ],
            "Resource": [
                "arn:aws:s3:::bucket-name",
                "arn:aws:s3:::bucket-name/*"
            ]
        }
    ]
}
| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.