AWS Transfer Family with custom policy

Question

Hi Folks, This is driving me crazy.

I am trying to set up AWS session policy that is bound to logged user. I followed this:

https://docs.aws.amazon.com/transfer/latest/userguide/requirements-roles.html#iam-policy-procedure

Policy is identical to the post:

```
{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "AllowListingOfUserFolder",
            "Action": [
                "s3:ListBucket"
            ],
            "Effect": "Allow",
            "Resource": [
                "arn:aws:s3:::${transfer:HomeBucket}"
            ],
            "Condition": {
                "StringLike": {
                    "s3:prefix": [
                        "${transfer:HomeFolder}/*",
                        "${transfer:HomeFolder}"
                    ]
                }
            }
        },
        {
            "Sid": "HomeDirObjectAccess",
            "Effect": "Allow",
            "Action": [
                "s3:PutObject",
                "s3:GetObject",
                "s3:DeleteObject",
                "s3:DeleteObjectVersion",
                "s3:GetObjectVersion",
                "s3:GetObjectACL",
                "s3:PutObjectACL"
            ],
            "Resource": "arn:aws:s3:::${transfer:HomeDirectory}/*"
        }
    ]
}
```

I am able to login but listing folders fail with access denied message in the log:

```
{
    "activity-type": "ERROR",
    "resource-arn": "arn:aws:transfer:us-east-1:123456789:server/s-4c2e20c02c9b434f8",
    "message": "Access denied",
    "session-id": "00239b9a2b32141f2edb"
}
```

If I attach second policy (below) to user role which allows access without any restriction then It works, but user has access to entire bucket, not to his own folder (as if 1st narrowed down policy is non existent):

```
{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "AllowListingOfUserFolder",
            "Action": [
                "s3:ListBucket",
                "s3:GetBucketLocation"
            ],
            "Effect": "Allow",
            "Resource": [
                "arn:aws:s3:::prod-sfpt-data"
            ]
        },
        {
            "Sid": "HomeDirObjectAccess",
            "Effect": "Allow",
            "Action": [
                "s3:PutObject",
                "s3:GetObject",
                "s3:GetObjectVersion"
            ],
            "Resource": "arn:aws:s3:::prod-sfpt-data/*"
        }
    ]
}
```

People suggested setting up two policies worked fine for them. Any help is appreciated.

Thanks.

Leo K · Answer

An IAM session policy does not grant permissions. It only defines the maximum set of permissions that the identity-based policies attached to the IAM role and resource-based policies in the same AWS account can grant (with some exceptions for advanced use of resource-based policies), in the absence of other policy mechanisms that might restrict them further.

You need to have a broad policy that applies to all relevant users, like the one you included attached to the IAM role, and you can use the per-user session policy to scope it down to each individual user's home folder, for example.

re:Post Agent · Answer

The issue you're experiencing with AWS Transfer Family and custom session policies is likely related to how the session policy is being applied and interpreted. Here are a few points to consider:

1. Session policies in AWS Transfer Family are stored as JSON blobs, not as ARNs. Make sure you're passing the policy as a JSON blob in the Policy argument when creating or updating the user.

2. The session policy you've provided uses variables like ${transfer:HomeBucket} and ${transfer:HomeFolder}. Ensure that these variables are being correctly populated with the appropriate values for your setup.

3. The session policy only applies when the domain of the ServerId is Amazon S3. If you're using Amazon EFS, session policies are not used.

4. The second policy you've attached to the user role is less restrictive and allows broader access to the S3 bucket. This is why it works when attached.

To troubleshoot:

1. Double-check that the HomeDirectory and HomeDirectoryType are correctly set for your user.

2. Verify that the ${transfer:HomeBucket} and ${transfer:HomeFolder} variables are being correctly substituted with the actual values.

3. Ensure that the Policy is being correctly applied to the user. You can use the UpdateUser or CreateUser API to set or update the session policy.

4. Consider temporarily broadening the permissions in your session policy to see if that resolves the issue, then gradually restrict them to find the right balance.

5. Check CloudTrail logs for more detailed information about the access denied errors.

If the issue persists, you may need to contact AWS support for further assistance, as there might be a specific configuration detail in your setup that's causing the problem.

**Sources**  
[CreateUser - AWS Transfer Family](https://docs.aws.amazon.com/transfer/latest/APIReference/API_CreateUser.html)  
[UpdateUser - AWS Transfer Family](https://docs.aws.amazon.com/transfer/latest/APIReference/API_UpdateUser.html)  
[CreateAccess - AWS Transfer Family](https://docs.aws.amazon.com/transfer/latest/APIReference/API_CreateAccess.html)

AWS Transfer Family with custom policy

Relevant content