2

I am trying to upload object to s3 bucket, encrypted with ONLY a specific KMS key. I have created a policy with separate deny conditions, but it does not seem to work. Can somebody suggest where could I be going wrong?

I tested this policy with AWS CLI - 

aws s3api put-object --bucket test-buck --key testimage.jpg --body testimage.jpg --ssekms-key-id arn:aws:kms:us-east-1:account-id:key/NOT-MY-key-id --server-side-encryption aws:kms

And I'm able to upload testimage.jpg using another key from my account, despite below deny statements.

The same policy works if I give it in Bucket policy, but here I want the policy to be assigned to my Role used by s3.

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "VisualEditor0",
            "Effect": "Deny",
            "Action": "s3:PutObject",
            "Resource": "arn:aws:s3:::test-buck/*",
            "Condition": {
                "StringNotEquals": {
                    "s3:x-amz-server-side-encryption": "aws:kms"
                }
            }
        },
        {
            "Sid": "VisualEditor1",
            "Effect": "Deny",
            "Action": "s3:PutObject",
            "Resource": "arn:aws:s3:::test-buck/*",
            "Condition": {
                "StringNotEquals": {
                    "s3:x-amz-server-side-encryption-aws-kms-key-id": "arn:aws:kms:us-east-1:<account-id>:key/<my-default-kmskey-id>"
                }
            }
        },
        {
            "Sid": "VisualEditor2",
            "Effect": "Deny",
            "Action": [
                "s3:PutObject",
                "s3:GetObject"
            ],
            "Resource": "arn:aws:s3:::test-buck/*",
            "Condition": {
                "Bool": {
                    "aws:SecureTransport": "false"
                }
            }
        }
    ]
}

Also, how can I test if NON ssl-requests are being denied? I can not use aws cli because I think it uses SSL when communicating with AWS services by default.

Thanks in advance.

s_neenu
  • 95
  • 2
  • 7
  • Can you explicitly add `--profile ` in your CLI command? where the `` should be replaced with the user with the above policy attached. – jellycsc May 30 '20 at 11:08
  • Tried that. It still lets me upload an object using other keys. I want to restrict that behavior, but policy doesn't seem to work with my role. – s_neenu May 31 '20 at 07:19
  • Seems this is a resource level policy, worked that way for me! – s_neenu Jun 26 '20 at 15:48

0 Answers0