Problem:
Understand bucket policy by experimenting with it.
Solution Summary:
Bucket policies determine whether a user, group, or role is authorized to do an operation on a S3 resource. We can specify JSON based bucket policies for your buckets under Permissions tab. To make it easier to create policies, AWS also provides a policy generator.
Prerequisites:
You need an AWS account and basic S3 familiarity.
Solution Steps:
-
Create a bucket (e.g. buddybucketpolicy) leaving all default selections as is.
-
Create a text file and upload it with default settings.
-
Verify that you get access denied warning when you try to access the file publicly.
-
Go to policy generator and generate policy as per the given policy description or copy paste the given policy json in bucket policy (editor) under Permissions tab.
Examples
Policy 1
{
"Id": "Policy1500985827175",
"Version": "2012-10-17",
"Statement": [
{
"Sid": "Stmt1500985820888",
"Action": [
"s3:GetObject"
],
"Effect": "Allow",
"Resource": "arn:aws:s3:::buddybucketpolicy/policytestfile.txt",
"Principal": "*"
}
]
}
Description: Allow everyone to access the file.
Policy 2:
{
"Id": "Policy1500985827175",
"Version": "2012-10-17",
"Statement": [
{
"Sid": "Stmt1500985820888",
"Action": [
"s3:GetObject"
],
"Effect": "Allow",
"Resource": "arn:aws:s3:::buddybucketpolicy/*",
"Principal": "*"
}
]
}
Description: Allow everyone to access all the files in bucket.
Policy 3:
{
"Id": "Policy1500985827175",
"Version": "2012-10-17",
"Statement": [
{
"Sid": "Stmt1500985820888",
"Action": [
"s3:GetObject"
],
"Effect": "Allow",
"Resource": "arn:aws:s3:::buddybucketpolicy",
"Principal": "*"
}
]
}
Description: Invalid Policy: Action does not apply to any resource(s) in statement.
Policy 4:
{
"Id": "Policy1500986383198",
"Version": "2012-10-17",
"Statement": [
{
"Sid": "Stmt1500986379681",
"Action": [
"s3:GetObject"
],
"Effect": "Allow",
"Resource": "arn:aws:s3:::buddybucketpolicy/*",
"Principal": {
"AWS": [
"arn:aws:iam::123456789012:user/heartinbt"
]
}
}
]
}
Description: Access to user heartinbt in account 123456789012.
Policy 5:
{
"Id": "Policy1500986383198",
"Version": "2012-10-17",
"Statement": [
{
"Sid": "Stmt1500986379681",
"Action": [
"s3:GetObject"
],
"Effect": "Allow",
"Resource": "arn:aws:s3:::buddybucketpolicy/*",
"Principal": {
"AWS": [
"123456789012"
]
}
}
]
}
Description: Access to user heartinbt in account 123456789012
Recent comments