User is able to List all AWS S3 buckets,though he cannot access it

Question

I have created the user who can access particular S3 bucket.But he is able to list all of S3 bucket.
Why is that so ? He must list only those S3 bucket for which he has the access

Why cannot he list only those bucket for which he has access granted ?

Accepted Answer

Hello,

Unfortunately, with the way the S3 permissions are structured they only allows a user to be granted access to either list all buckets within the S3 account or not be able to list any buckets at all. This is because to list buckets within S3 we grant the permission `s3:ListAllMyBuckets` permission, however, this also requires the policy resource to be `"arn:aws:s3:::*"` . If the resource is a specific bucket then an AccessDenied error will occur, and the user will not be able to list any of the buckets within the S3 account.
Instead if you would just like to grant access to one bucket and its objects you can remove the `s3:ListAllMyBuckets`  permission and grant the `S3 permission s3:ListBucket`  and have the policy resource listed as `"arn:aws:s3:::BucketName"` . This way the user can only access the specific bucket. Add  `s3:PutObject`  and `s3:GetObject`  permissions to modify contents of specific bucket if needed.
For further reference take a look at this doc [to grant a user Amazon S3 console access to only a certain bucket or folder.](https://repost.aws/knowledge-center/s3-console-access-certain-bucket)

Answer

It is hard to tell without looking at IAM policy attached to the user. Probably, you can check what permissions are granted to the user.  If we want to restrict the user to a single bucket, please refer the sample policy below.

```
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "s3:ListBucket"
      ],
      "Resource": "arn:aws:s3:::SAMPLE-BUCKET"
    },
    {
      "Effect": "Allow",
      "Action": [
        "s3:PutObject",
        "s3:GetObject"
      ],
      "Resource": "arn:aws:s3:::SAMPLE-BUCKET/*"
    }
  ]
}
```

If we want to allow the user to list all buckets, see the sample IAM policy below. The actions `s3:ListAllMyBuckets ` and `s3:GetBucketLocation` will grant the user to list all buckets.

```
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "s3:GetBucketLocation",
        "s3:ListAllMyBuckets"
      ],
      "Resource": "*"
    },
    {
      "Effect": "Allow",
      "Action": ["s3:ListBucket"],
      "Resource": ["arn:aws:s3:::SAMPLE-BUCKET"]
    },
    {
      "Effect": "Allow",
      "Action": [
        "s3:PutObject",
        "s3:GetObject"
      ],
      "Resource": ["arn:aws:s3:::SAMPLE-BUCKET/*"]
    }
  ]
}
```

Answer

Yea,this is fine.
Issue is,we do not want user to List all buckets,instead list only the permitted bucket

User is able to List all AWS S3 buckets,though he cannot access it

Relevant content