Grant access to only one bucket in S3

Question

I´m trying to write a policy to grant a specific user access to only one bucket

this is what I have so far:

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "s3:GetBucketLocation",
                "s3:ListAllMyBuckets"
            ],
            "Resource": "arn:aws:s3:::*"
        },
        {
            "Effect": "Allow",
            "Action": "s3:*",
            "Resource": [
                "arn:aws:s3:::MYBUCKET",
                "arn:aws:s3:::MYBUCKET/*"
            ]
        }
    ]
}

I don´t want this user to list all other buckets so I changed "Resource": "arn:aws:s3:::*" to "Resource": "arn:aws:s3:::MYBUCKET" but it didn´t work. I don´t need this user to access the console just programmatically is fine. thank you!!

score 3 · Accepted Answer · answered Jul 04 '17 at 22:09

It is not possible to limit the results of the ListAllMyBuckets command. Either they see the list of all the buckets, or they see none at all.

If they know which bucket they wish to use, then you could simply remove permission to list buckets. They will still be able to list the contents of MYBUCKET and upload/download objects. They just won't be able to request a list of buckets. (And the S3 Management Console won't function because it expects to be able to list all buckets in the account)

Grant access to only one bucket in S3

1 Answers1