How do I allow users to download from and upload to an Amazon S3 bucket that I encrypted with a customer managed AWS KMS key?

4 minute read

I set up my Amazon Simple Storage Service (Amazon S3) bucket to use default encryption with a customer managed AWS Key Management Service (AWS KMS) key. I want to allow an AWS Identity and Access Management (IAM) user to download objects from and upload objects to the bucket.

Resolution

First, modify the AWS KMS key policy. Then, modify the identity-based policy for the IAM user. If the IAM user is in a different account than the S3 bucket, then you must also modify the bucket policy.

Modify the key policy

Complete the following steps:

Open the AWS KMS console.
In the navigation pane, choose Customer managed keys, and then select your key in the list of keys.
Choose the Key policy tab to view the policy document.
Note: If you used the AWS KMS console to create the customer managed key, then you must choose Switch to policy view on the Key policy tab to view the policy document.

Choose Edit, and then add the following statement to the key policy to grant the kms:GenerateDataKey and kms:Decrypt permissions:

{
  "Sid": "ExampleStmt",
  "Action": [
    "kms:Decrypt",
    "kms:GenerateDataKey"
  ],
  "Effect": "Allow",
  "Principal": {
    "AWS": "arn:aws:iam::111122223333:user/Jane"
  },
  "Resource": "*"
}

Note: The preceding example policy statement includes only the minimum required permissions to download and upload objects to an encrypted S3 bucket. You can add more permissions based on your use case.

Modify the identity-based policy for same account access

Complete the following steps:

Open the IAM console.

Attach the following policy to the IAM user so that the user can upload and download objects from the bucket:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "ExampleStmt",
      "Action": [
        "s3:GetObject",
        "s3:PutObject"
      ],
      "Effect": "Allow",
      "Resource": "arn:aws:s3:::DOC-EXAMPLE-BUCKET/*"
    }
  ]
}

Note: Replace the Resource value with the bucket's Amazon Resource Name (ARN). The wildcard (*) represents the object in the bucket.

Important: An explicit Deny statement in a bucket policy blocks the permissions that an identity-based policy grants. Review the bucket policy to confirm that there isn't an explicit Deny statement that conflicts with the identity-based policy.

Modify the identity-based policy and bucket policy for cross-account access

Important: You can grant cross-account access for a customer managed key but not for an AWS managed key. You can't modify the key policy of an AWS managed key.

Complete the following steps:

Open the IAM console in the IAM user account.

Attach the following policy to the IAM user so that the user can upload and download objects and use the AWS KMS key:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "DownloadandUpload",
      "Action": [
        "s3:GetObject",
        "s3:GetObjectVersion",
        "s3:PutObject",
        "s3:PutObjectAcl"
      ],
      "Effect": "Allow",
      "Resource": "arn:aws:s3:::DOC-EXAMPLE-BUCKET/*"
    },
    {
      "Sid": "ListBucket",
      "Action": [
        "s3:ListBucket"
      ],
      "Effect": "Allow",
      "Resource": "arn:aws:s3:::DOC-EXAMPLE-BUCKET"
    },
    {
      "Sid": "KMSAccess",
      "Action": [
        "kms:Decrypt",
        "kms:GenerateDataKey"
      ],
      "Effect": "Allow",
      "Resource": "arn:aws:kms:example-region-1:123456789098:key/111aa2bb-333c-4d44-5555-a111bb2c33dd"
    }
  ]
}

Note: Replace the Resource values with the ARNs for your bucket and AWS KMS key. The wildcard (*) represents the object in the bucket.

Open the Amazon S3 console in the account that owns the S3 bucket.

Add the following statement to the bucket policy to grant the IAM user access to the bucket:

{
  "Id": "Policy1584399307003",
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "DownloadandUpload",
      "Action": [
        "s3:GetObject",
        "s3:GetObjectVersion",
        "s3:PutObject",
        "s3:PutObjectAcl"
      ],
      "Effect": "Allow",
      "Resource": "arn:aws:s3:::DOC-EXAMPLE-BUCKET/*",
      "Principal": {
        "AWS": [
          "arn:aws:iam::111122223333:user/Jane"
        ]
      }
    },
    {
      "Sid": "ListBucket",
      "Action": [
        "s3:ListBucket"
      ],
      "Effect": "Allow",
      "Resource": "arn:aws:s3:::DOC-EXAMPLE-BUCKET",
      "Principal": {
        "AWS": [
          "arn:aws:iam::111122223333:user/Jane"
        ]
      }
    }
  ]
}

Note: Replace the Id with your bucket policy's ID, Principal value with the IAM user's ARN and the Resource values with the ARNs for your bucket.

In addition to the minimum required permissions for cross-account access, you can grant s3:PutObjectAcl permission so that the IAM user can set the access control list (ACL) for an object. Then, grant the bucket-owner-full-control canned ACL to the bucket account. You can also grant the s3:ListBucket permission that's required to sync S3 directories or prefixes and copy objects between buckets.