Restrict List of Buckets for a Specific User

Question

I've been able to generate a user policy that only gives access to a specific bucket, however after trying everything (including this post: Is there an S3 policy for limiting access to only see/access one bucket?).

The problem: I am unable to restrict the listing of the buckets down to just one bucket. For a variety of reasons, I do not want the listing to show any buckets other than the one specified.

I've tried a variety of policies, to no avail. Here's my latest policy JSON which is working as far as restricting operations, but not listing:

{
    "Statement": [
    {
        "Effect": "Allow",
        "Action": [
            "s3:ListAllMyBuckets",
            "s3:ListBucket",
            "s3:GetBucketLocation"
        ],
        "Resource": "arn:aws:s3:::*"
    },
    {
        "Effect": "Deny",
        "Action": [
            "s3:ListBucket"
        ],
        "NotResource": [
            "arn:aws:s3:::acgbu-acg",
            "arn:aws:s3:::acgbu-acg/*"
        ]
    },
    {
        "Effect": "Allow",
        "Action": [
            "s3:*"
        ],
        "Resource": [
            "arn:aws:s3:::acgbu-acg",
            "arn:aws:s3:::acgbu-acg/*"
        ]
    }
]
}

Any help would be greatly appreciated. I'm beginning to wonder if it's even possible.

Related: [Is there an S3 policy for limiting access to only see/access one bucket?](https://stackoverflow.com/q/6615168/55075) & [How to provide a user to access only a particular bucket in AWS S3?](https://devops.stackexchange.com/q/1626/3) — kenorb, Sep 29 '17 at 13:39

score 39 · Accepted Answer · edited May 23 '17 at 11:33

39

It is not currently possible to restrict the list of buckets to show only one bucket.

The AWS console relies on the ListAllMyBuckets action to get the list of buckets owned by the user, but the returned list can not be restricted by using an Amazon Resource Name (or ARN; the only ARN that's allowed for ListAllMyBuckets is arn:aws:s3:::*).

This limitation isn't clearly explained in the official AWS docs, but ListAllMyBuckets is a service level API call (it's also called GET Service in the REST API), not a bucket level API call and its associated ARN in the IAM policy refers to the S3 service an not to a specific bucket.

For possible workarounds, see this answer on StackOverflow:

edited May 23 '17 at 11:33

Community

1
1

answered Sep 23 '13 at 10:06

dcro

13,294
4
66
75

Thanks for the answer. I had seen that post - I had really dug into this a lot. We went with the option of clients cannot see their own buckets, which is a shame, but is the best option given our primary concerns. – random_user_name Sep 23 '13 at 16:13
[This answer](https://stackoverflow.com/a/30961920) has very useful information, too. – AndreKR Jun 24 '17 at 09:05
We just hit this issue too. It seems to me this shouldn't be something we just accept as normal. We run several projects, and if I want an employee to only see one bucket when they go to the S3 section then that should be possible. – JeremyTM Dec 04 '17 at 03:01

score 3 · Answer 2 · answered Apr 22 '14 at 23:36

The free "S3 Browser" (this works on my version 3-7-5) allows users with the proper permissions to "Add External Bucket" for the account, all they need to know is the name of the bucket. This allows them to "see" their bucket and the contents (and what ever abilities they've been given inside that bucket), they won't see any of the other buckets.

To make the bucket "play nice" with the S3 Browser behavior, I suggest the following IAM Policy for the User or Group:

{
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "s3:ListBucket",
        "s3:GetBucketLocation",
        "s3:GetBucketAcl"
      ],
      "Resource": "arn:aws:s3:::acgbu-acg"
    },
    {
      "Effect": "Allow",
      "Action": [
        "s3:PutObject",
        "s3:GetObject",
        "s3:GetObjectAcl",
        "s3:DeleteObject"
      ],
      "Resource": "arn:aws:s3:::acgbu-acg/*"
    }
  ]
}

It's a work around, and it's okay if the user only needs to do it once. But if the buckets your user is accessing are changing around a lot then this work around isn't very practical.

The "Add External Bucket" portion of this answer was the real solution for "S3 Browser", I recommend IAM Policy part be thoughtfully crafted not copied. I copied the S3ReadOnly Action's block for example ;) — ThorSummoner, Mar 01 '16 at 19:27

score 0 · Answer 3 · answered Mar 08 '17 at 17:45

I came here looking for how to restrict access to a bucket to one (or a list of) user(s). Maybe, post title is ambiguous ?

Anyway, it seems to have Google's favor, so let's enrich it a little :
If you need to restrict access to a bucket to some user(s), follow those steps :

First, get the IDs of the user you want to grant rights to.
This can be achieved using the awscli command aws iam list-users
Those IDs look like this : "AIDAIFKYAC9DNJXM2CRD", or "AIDAZ362UEKJCJMFFXCL"
Please, comment if it's available in the web console.

Once you got the ID(s) that must be given access, put a policy on the bucket you want to protect.
To do this with the web console :
-> Open S3 -> Open your bucket -> Select the "properties" tab -> Click on "Edit bucket policy"

To apply the policy using awscli, create a file with the policy's content, and put it on your bucket using this command :
aws s3api put-bucket-policy --bucket NAME_OF_YOUR_BUCKET --policy file:///path/to/policyFile.json
Of course, set YOUR_BUCKET_NAME and the file's path to your values, BUT DON'T remove the file:// prefix before your file's name

Warning : this deny policy will override the default "access to s3" a user could have. This means you can deny access to your OWN user with this. Use with caution !
I'm even afraid you could make a bucket fully innaccessible.
Out of curiosity, I tried accessing with our account's root user, which I didn't grant access to, and effectively couldn't.
Gotta ask this to support, and hopefully update this answer.

Anyway, I'm sure you'll be careful enough, so here's a sample policy.
Just replace the bucket's name with yours and the userId(s) with the one(s) you want to authorize to access.

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Deny",
      "Principal": "*",
      "Action": "s3:*",
      "Resource": [
        "arn:aws:s3:::your-bucket-name",
        "arn:aws:s3:::your-bucket-name/*"
      ],
      "Condition": {
        "StringNotLike": {
          "aws:userId": [
            "AIDAXAXAXAXAXAXAXAXAX",
            "AIDAOXOXOXOXOXOOXOXOX",
            "AIDAXIXIXIXIXIXIXIXIX"
          ]
        }
      }
    }
  ]
}

For something more specific, or if you want to use roles instead of users, see this AWS post explaining in detail how to restrict access to a buckets

Hope this helps

Logic is backwards. You are restricting every other user besides the ones chosen. — Kevin Buchs, Feb 20 '18 at 21:05
@Kevin Can you precise please ? Denying for everyone except the allowed-one(s) seems to be the normal way of applying security to me. And btw, you can also apply this policy to multiple buckets. I didn't went much deeper with this atm, but I would appreciate more details if I did something wrong. — Balmipour, Feb 21 '18 at 09:11
The original poster was asking about a user policy. This would be attached to particular user(s) while others may have more leineint policies (or no policy) applied to them. A typical use case would be where you only want to restrict one user, whose credentials need to be shared outside the highest trust group. User policy is the way to go for that. — Kevin Buchs, Feb 25 '18 at 13:35

score -1 · Answer 4 · answered Feb 23 '18 at 20:12

-1

The original poster was asking about a user policy. This would be attached to particular user(s) while others may have more leineint policies (or no policy) applied to them. A typical use case would be where you only want to restrict one user, whose credentials need to be shared outside the highest trust group. User policy is the way to go for that..

answered Feb 23 '18 at 20:12

Kevin Buchs

2,520
4
36
55

Thanks for posting. Example of what that might look like? – random_user_name Feb 23 '18 at 21:25
@cale_b Sorry - I didn't mean my comment to be placed as an answer. I was replying to a question in the comments for the last answer. So, in that context it might make more sense. I agree with you accepted answer, that you cannot restrict the list of buckets seen. It is all or nothing. You can restrict the listing of objects within buckets to particular buckets, however. And if you want an example of that, I can share that here. – Kevin Buchs Feb 25 '18 at 13:39

Restrict List of Buckets for a Specific User

4 Answers4

Linked

Related