Understanding Access Control in AWS S3

Question

I have created an S3 bucket and want to restrict access to my applications alone, blocking all public access.  I checked block all public access checkbox, and I did not grant any permissions. Initially, I assumed I wouldn't be able to access the S3 bucket. While this holds true for public access, my application can still access it.

I'm unsure if this is due to my access ID and key, which serve as credentials (bucket owner has read and write permissions). The credentials used by my application have admin access, allowing them to access all my services. I recognize the necessity of providing limited access. Could this unrestricted access be the reason my application can access the S3 bucket despite blocking public networks and not granting explicit permissions?

Answer

Short answer to your question is yes.  If your IAM keys and your instance's IAM profiles/roles contain `s3:*` that will allow writing to any bucket that has default permissions.  You can remove the permissions to not allow instances to write to buckets if they do not need to.

On the bucket side, you should add Bucket Policies which control who/what resources are allowed to perform what actions against them.  See details of bucket policies [here](https://docs.aws.amazon.com/AmazonS3/latest/userguide/using-iam-policies.html).  Suggested policy would be to only allow specific roles or specific instances to read/write from each bucket.

Answer

Hello.

> I'm unsure if this is due to my access ID and key, which serve as credentials (bucket owner has read and write permissions).

I think it depends on how you are accessing S3 from your application, but I think there is a connection.  
Public access to S3 allows downloading by directly accessing the S3 object URL.  
https://docs.aws.amazon.com/AmazonS3/latest/userguide/access-bucket-intro.html

Therefore, even if all public access is set to be blocked, I suspect that the reason why access is possible is because the application is downloading the object via the AWS API using an SDK etc.  
Try editing the IAM policy in a test environment to disable access to S3, and if the object cannot be displayed, you will know that access is using IAM.

Understanding Access Control in AWS S3

관련 콘텐츠