REST API to Retrieve All Accessible Users for a Specific S3 Bucket (Without AWS SDK)

Question

We are implementing a feature where an admin can connect their AWS account, allowing us to access S3 bucket data (PDFs, PPTX files, etc.) for training a model. Users in the organization can then query the model, and it provides answers based on the stored documents.

However, not all users have access to every S3 bucket. To enforce access control, we need to determine which S3 bucket the data was retrieved from and verify whether a specific user has permission to access that bucket. If a user lacks the necessary permissions, we must restrict their access to that data.
I have already checked the bucket policy and ACL, but I noticed that if an IAM user has been granted access through an IAM policy (instead of being explicitly mentioned in the bucket policy), they can still access the bucket. This makes it difficult to determine all users who have permissions.

Requirements:
* We are not using AWS SDK and need to achieve this using RESTful APIs only.
* We need an AWS API endpoint that allows us to retrieve a list of all users who have access to a particular S3 bucket.
Is there a RESTful API available that provides this information? If not, what alternative approach can be used to achieve this requirement without relying on the AWS SDK?
Any guidance or best practices would be greatly appreciated!

re:Post Agent · Answer

Unfortunately, there isn't a single RESTful API endpoint that directly provides a list of all users who have access to a particular S3 bucket without using the AWS SDK. This is a complex task due to the various ways access can be granted in AWS (bucket policies, IAM policies, ACLs, etc.).

However, you can use a combination of approaches to gather this information:

1. Use the S3 API to retrieve the bucket policy and ACLs. This will give you information about permissions set directly on the bucket.

2. Use the IAM API to list all users and roles in the account, then retrieve their policies to check for S3 permissions.

3. If you're using AWS Organizations, you can use the ListCallerAccessGrants API to get information about S3 Access Grants for IAM principals and IAM Identity Center users. This API returns the S3 Access Grants for users and their groups based on group membership in AWS IAM or an Identity Provider.

4. Consider implementing a custom solution where you maintain a separate database or configuration file that maps users to their S3 bucket permissions. You would need to keep this updated as permissions change in AWS.

5. Implement a proxy or middleware layer that intercepts and logs all S3 access attempts. This could help you build a list of users who actually access each bucket.

Remember that determining exact permissions can be challenging due to the potential complexity of IAM policies and their interactions. Your solution may need to be approximate or require periodic manual review.

Also, be aware that listing all users with access to a bucket could potentially expose sensitive information. Ensure you have proper authorization and security measures in place when implementing this feature.  
**Sources**  
[Amazon S3 Access Grants introduce the ListCallerAccessGrants API - AWS](https://aws.amazon.com/about-aws/whats-new/2024/09/amazon-s3-access-grants-listcalleraccessgrants-api/)  
[Add users in organization to S3 buckets | AWS re:Post](https://repost.aws/questions/QUucmCNyEvQc2uAj2uVUSuUw/add-users-in-organization-to-s3-buckets)  
[Getting started with Amazon S3 - Amazon Simple Storage Service](https://docs.aws.amazon.com/AmazonS3/latest/userguide/GetStartedWithS3.html)

REST API to Retrieve All Accessible Users for a Specific S3 Bucket (Without AWS SDK)

Add your answer

Relevant content