s3 bucket/IAM user policy "Deny takes priority above all other access"?

Question

Two policies, got one "Deny", I should not be able to do any operations to bucket, but I can still list and view bucket objects. Why? Thanks

S3 bucket policy

{
    "Sid": "S3DenyAccess",
    "Effect": "Deny",
    "Principal": "*",
    "Action": "*",
    "Resource": "arn:aws:s3:::<YOURBUCKETHERE>/*"
}

IAM user policy

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "AllowConsoleAccess",
            "Action": [
                "s3:ListAllMyBuckets",
                "s3:GetBucketLocation"
            ],
            "Effect": "Allow",
            "Resource": [
                "arn:aws:s3:::*"
            ]
        }
    ]
}

score 2 · Answer 1 · answered Aug 17 '20 at 04:39

2

Try changing the Resource in the Bucket policy to include both the bucket alone and the bucket with objects:

"Resource": [
    "arn:aws:s3:::<YOURBUCKETHERE>",
    "arn:aws:s3:::<YOURBUCKETHERE>/*"
]

Hope that helps :)

answered Aug 17 '20 at 04:39

MLu

24,849
5
59
86

Hi, this works fine, I am not able to visit my bucket now, even my root user account. Thanks! – Shawn Aug 24 '20 at 07:43
@Shawn can you accept this as the right answer if it's working for you? – Gi0rgi0s Jan 05 '22 at 17:16

score 2 · Answer 2 · answered Aug 17 '20 at 08:03

AWS Policy Evaluation Logic would be a useful read. In short, an explicit deny wins. It's not relevant here though.

IAM

Your IAM user policy is saying "this user can list all buckets a get bucket locations".

Bucket Policy

Your bucket policy for one specific bucket is saying "explicitly deny permissions for anyone to do anything to object inside the bucket". The "/*" at the end of the resource means the policy applies "inside the bucket", whereas if you omit those it means the policy applies to the bucket itself.

Combined

So your combined policies say all the user can list buckets and get bucket locations but cannot do anything with objects inside the bucket. I'm surprised you can list objects in the bucket and view the bucket objects. I suspect another policy is in play here, because the AWS default deny says it shouldn't be showing you anything.

Other Opinions

If anyone can spot something I've missed please point it out :)

Thanks Time, yes that's why I feel surprised too, but anyway, thank you so much for you help! Appreciate. — Shawn, Aug 24 '20 at 07:42

s3 bucket/IAM user policy "Deny takes priority above all other access"?

2 Answers2