Amazon S3 Bucket Policy — Different Usecase to Allow & Restrict Access

Introduction:

In AWS, there are two types of IAM Policy.

• Identity Policy: This policy are used to specify which actions are allowed or denied on AWS services/resources for a particular User or Role or Group
• Resource Policy: This policy allows to specify who can have access to this particular resource. And this can only be attached to Resource. Not for all AWS resources. Only for Resources like SQS, SNS, VPC Endpoint, Kinesis, S3 Bucket etc.

S3 Bucket Policy:

• S3 bucket policy is type of Resource based Policy
• S3 bucket policies can be attached to only S3 buckets.
• With the S3 bucket policy, you can specify which actions are allowed or denied on that bucket for some users.

How to Apply S3 Bucket Policy ?

• AWS Management Console > Services > S3 > Choose S3 Bucket
• Go to Permission Tab > Scroll down to choose “Bucket Policy” section and Edit

S3 Bucket Policy in Permission Tab

In this post, would like to cover different scenario / use-cases — how S3 Bucket policy can be leveraged.

UseCase #1 : Allow the bucket access only through Https protocol

It is always important to perform read or write operation in secure channel (TLS / SSL) layer. Following bucket policy shows how to enforce to use Secure Transport layer for reading object from S3 bucket.

{
  "Id": "HttpsExamplePolicy",
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "AllowSSLRequests",
      "Action": "s3:GetObject",
      "Effect": "Allow",
      "Resource": [
        "arn:aws:s3:::s3-bucket-policy-examples/*"
      ],
      "Condition": {
        "Bool": {
          "aws:SecureTransport": "true"
        }
      },
      "Principal": "*"
    }
  ]
}

UseCase #2 : Allow the bucket access only from specific IP Address

Some times we would like to restrict access of performing operation in S3 bucket only from trusted source (or) request coming from specific source IP address. Here is the sample policy —

{
  "Version": "2012-10-17",
  "Id": "SpecificIpPolicyExample",
  "Statement": [
    {
      "Sid": "IPAllow",
      "Effect": "Deny",
      "Principal": "*",
      "Action": "s3:*",
      "Resource": [
        "arn:aws:s3:::s3-bucket-policy-examples",
               "arn:aws:s3:::s3-bucket-policy-examples/*"
      ],
      "Condition": {
  "NotIpAddress": {"aws:SourceIp": "192.168.0.1/32"}
      }
    }
  ]
}

UseCase #3 : Restricting access to specific HTTP Referer or website

Let’s say you have external web applications which needs to perform read or write objects in S3 bucket, we can have the following policy which allows to perform operation only specific website

{
  "Version":"2012-10-17",
  "Id":"Http Referer Policy example",
  "Statement":[
    {
      "Sid":"Allow get requests originating from www.my-website.com and my-website.com.",
      "Effect":"Allow",
      "Principal":"*",
      "Action":["s3:GetObject","s3:GetObjectVersion"],
      "Resource":"arn:aws:s3:::s3-bucket-policy-examples/*",
      "Condition":{
        "StringLike":{"aws:Referer":["http://www.my-website.com/*","http://my-website.com/*"]}
      }
    }
  ]
}

UseCase #4 : Allowing public read access to S3 Bucket

Sometimes, we would like to allow public read access to perform read operation from S3 bucket. Here is the sample bucket policy to attach to S3 bucket.

{
  "Version":"2012-10-17",
  "Statement":[
    {
      "Sid":"PublicRead",
      "Effect":"Allow",
      "Principal": "*",
      "Action":["s3:GetObject"],
      "Resource":["arn:aws:s3:::s3-bucket-policy-examples/*"]
    }
  ]
}

UseCase #5: Allow Cross Account Access to S3 Bucket

Let’s say we have two AWS Accounts “Account-A” and “Account-B”. This example policy — shows how User “John” in Account-B can access read and write objects in S3 Bucket “s3-bucket-policy-examples” in “Account-A”

{
   "Version": "2012-10-17",
   "Statement": [
      {
         "Sid": "Cross Account permissions",
         "Effect": "Allow",
         "Principal": {
            "AWS": ["arn:aws:iam::Account-B:root", 
                    "arn:aws:iam::Account-B:user/John"]
         },
         "Action": [
            "s3:GetLifecycleConfiguration",
            "s3:ListBucket",
            "s3:GetObject",
            "s3:PutObject"
         ],
         "Resource": [
            "arn:aws:s3:::s3-bucket-policy-examples", 
                   "arn:aws:s3:::s3-bucket-policy-examples/*"
         ]
      }
   ]
}

Conclusion:

Some times we feel difficult in composing IAM Policy. We have options to generate Resource Policy or S3 Bucket Policy from Policy Generator. Here is the link https://awspolicygen.s3.amazonaws.com/policygen.html

Policy Generator