User to view the buckets but not allowed to create a bucket

Question

I am trying to configure my IAM policy which would allow a user to only view the bucket and place objects, delete and update the folder/files within that bucket, but deny bucket creation. I have already added the following to my IAM policy but it is of no use as it will still allow the user to create a bucket. How to achieve this goal?

```
	"Version": "2012-10-17",
	"Statement": [
		{
			"Action": [
				"s3:ListAllMyBuckets"
			],
			"Effect": "Allow",
			"Resource": [
				"arn:aws:s3:::*"
			]
		},
                {
			"Effect": "Deny",
			"Action": "s3:CreateBucket",
			"Resource": "*"
		},
		{
			"Effect": "Deny",
			"Action": "s3:CreateBucket",
			"NotResource": "arn:aws:s3:::*"
		},
		{
			"Action": [
				"s3:ListBucket",
				"s3:GetBucketLocation"
			],
			"Effect": "Allow",
			"Resource": "arn:aws:s3:::my-bucket"
		},
		{
			"Effect": "Allow",
			"Action": [
				"s3:GetObject",
				"s3:PutObject",
				"s3:DeleteObject"
			],
			"Resource": "arn:aws:s3:::my-bucket/*"
		}
	]
}
```

Answer

Hello,

the second deny seems to contradict this by trying to allow the same action on any resource not matching

{
			"Effect": "Deny",
			"Action": "s3:CreateBucket",
			"NotResource": "arn:aws:s3:::*"
		},

Answer

To achieve your goal of allowing a user to view and manage objects within a specific S3 bucket, but denying the ability to create new buckets, you can use the following IAM policy:

```json
{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "s3:ListBucket",
                "s3:GetBucketLocation"
            ],
            "Resource": "arn:aws:s3:::my-bucket"
        },
        {
            "Effect": "Allow",
            "Action": [
                "s3:GetObject",
                "s3:PutObject",
                "s3:DeleteObject"
            ],
            "Resource": "arn:aws:s3:::my-bucket/*"
        },
        {
            "Effect": "Deny",
            "Action": "s3:CreateBucket",
            "Resource": "*"
        }
    ]
}
```

Here's what this policy does:

1. The first statement allows the user to list the contents of the `my-bucket` bucket and get the bucket's location.
2. The second statement allows the user to get objects, put objects, and delete objects within the `my-bucket` bucket.
3. The third statement explicitly denies the `s3:CreateBucket` action on all resources (`*`), effectively preventing the user from creating new buckets.

User to view the buckets but not allowed to create a bucket

Relevant content