Here are a couple of quick example IAM policies to secure a user on AWS S3 access either to a single bucket, or a sub folder in a S3 bucket (shared bucket). Using these rules should allow users to use tools like cloudberry or S3fox without problems, if you are too strict these tend to fail.
First log into the AWS console and create a new IAM user, then just edit the below policies and change the <>’s to your required values. You then need to paste that into a custom policy for your newly created user.
Lock a user into a S3 bucket
You’ll need to let the user list all the bucket names in order to allow a lot of the third party tools to work. If they try and browse the wrong bucket they’ll get access denied.
{
"Statement":[{
"Effect":"Allow",
"Action":"s3:ListAllMyBuckets",
"Resource":"arn:aws:s3:::*"
},
{
"Effect":"Allow",
"Action": [
"s3:ListBucket",
"s3:ListBucketMultipartUploads",
"s3:ListBucketVersions"
],
"Resource":"arn:aws:s3:::<your_bucketname>"
},
{
"Effect":"Allow",
"Action": [
"s3:*Object*",
"s3:ListMultipartUploadParts",
"s3:AbortMultipartUpload"
],
"Resource":"arn:aws:s3:::</your_bucketname><your_bucketname>/*"
}
]
}
To break this policy down rule by rule:
- Allow all bucket names to be listed in the account.
- Allow all files and folders within the specified bucket to be listed.
- Allow a user to add and delete files and folders within the specified bucket and sub folder.
Lock a user into a single directory in a S3 shared bucket
This is more complex, as you have to allow a user to list all the folders in a bucket in order for the tools like S3fox to work but then deny anything else below in all but the allowed directories.
{
"Statement":[{
"Effect":"Allow",
"Action":"s3:ListAllMyBuckets",
"Resource":"arn:aws:s3:::*"
},
{
"Effect":"Allow",
"Action":"s3:ListBucket",
"Resource":"arn:aws:s3:::</your_bucketname><your_bucketname>"
},
{
"Effect":"Deny",
"Action": [
"s3:ListBucket",
"s3:ListBucketMultipartUploads",
"s3:ListBucketVersions"
],
"Resource":"arn:aws:s3:::</your_bucketname><your_bucketname>",
"Condition":{
"StringLike":{
"s3:prefix":"*/*"
},
"StringNotLike": {
"s3:prefix": "<your_folder>/*"
}
}
},
{
"Effect":"Allow",
"Action": [
"s3:*Object*",
"s3:ListMultipartUploadParts",
"s3:AbortMultipartUpload"
],
"Resource":"arn:aws:s3:::<your_bucketname>/<your_folder>/*"
}
]
}
To break this rule set down rule by rule:
- Allow all bucket names to be listed in the account.
- Allow all files and folders within the specified bucket to be listed.
- Deny be default listing files within a directory except for the specified folder.
- Allow a user to add and delete files and folders within the specified bucket and sub folder.
