S3 Bucket Policy for Federated User

Question

I understand that Principle element is must for resource-based policies. Which means while creating S3 Bucket policy, I need to define Principle element. In my case, I want to define Bucket policy for Azure AD users.

I have already configured IAM Identity Center with Azure AD as external saml idp. I can login with Azure AD user to AWS console and access the resources using Permission sets.

How can I define Azure AD users (federated users) as Principle element in Bucket policy? I know there are other ways to manage S3 permissions, however I want to use only S3 Bucket policy (resource based policy). Is it possible to use federated user as Principle element in resource based policy?

Answer

Hi. You will be able to achieve your goal by using Condition element .
BucketPolicy will like this.

```
{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "UserID",
            "Effect": "Allow",
            "Principal": "*",
            "Action": [
                "s3:GetObject",
                "s3:GetObjectVersion"
            ],
            "Resource": "arn:aws:s3:::mybucket/*",
            "Condition": {
                "StringLike": {
                    "aws:userId": "AROAEXAMPLEID:SSOUserName"
                }
            }
        }
    ]
}
```

You can find out what  aws:userid variable is from here.

https://aws.amazon.com/jp/blogs/security/how-to-restrict-amazon-s3-bucket-access-to-a-specific-iam-role/

> Each IAM entity (user or role) has a defined aws:userid variable. You will need this variable for use within the bucket policy to specify the role or user as an exception in a conditional element. An assumed-role’s aws:userId value is defined as UNIQUE-ROLE-ID:ROLE-SESSION-NAME (for example, AROAEXAMPLEID:userdefinedsessionname)

Answer

Hi, you can use federated users as IAM Principals in policies:  see https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_principal.html#sts-session-principals

This page provides an example:
```
"Principal": { "AWS": "arn:aws:sts::AWS-account-ID:federated-user/user-name" }
```

You can sophisticate this by using implicit variable ${AWS:UserId} and check other conditions on this Userid if needed (matches some pattern, etc.)

S3 Bucket Policy for Federated User

Relevant content