1

I have an Organization that has three accounts in it, and I have attached a FullAWSAccess control policy to one of those accounts A. This policy grants * action to * resources.

A logged in to the AWS web console, got their canonical User Id from the security screen (shown below), and gave me that ID. I then put that ID into the bucket's ACL as a user with all permissions.

What I thought would happen is that the user will see the bucket listed in their S3 web console, but instead while the user can go to the link for that bucket, they can't see it listed.

Is there any additional action I or user A can take for the account to see the S3 buckets rather than have to bookmark the bucket's link?

Edit: The above was edited from the original post based on @tim's comment. Also, I realize based on this comment that perhaps the answer is that the best and perhaps only way to do the above is use cross-account access which I have yet to try out.

Where I got the canonical ID from AWS Security Credentials screen

Improve this question
3
  • Organisations are irrelevant in this context. Accounts don't see S3 buckets, users or roles do. You can grant cross account access to the whole account, or you can use bucket policy to share just the buckets with another account. I don't quite understand the requirement to "upload files to buckets via the browser" - do you mean you want users to have S3 console access so they can use the AWS web interface? Suggest you edit your question to make it a bit more precise.
    – Tim
    Aug 1, 2019 at 8:06
  • Would it clarify things if I rewrote a portion of my question as, "Person A logged in with an email/password on the browser, and gave me the Canonical User ID. I put this User ID into my bucket's list of allowed users in its ACL"? I can also remove the Organization part. And yes, I "want users to have S3 console access so they can use the AWS web interface"
    – sameers
    Aug 1, 2019 at 9:19
  • 1
    Suggest you edit your question to remove references to organisations as pretty much all they provide is billing and SCP, they just complicate the question. When you say "logged in" you should say to what, and when you say "upload" you should say "upload using the AWS S3 console". My answer stands though, bucket policy or let users assume roles into the account with the bucket.
    – Tim
    Aug 1, 2019 at 18:10

0

Reset to default

You must log in to answer this question.

Browse other questions tagged .