Problem on s3:ExistingObjectTag Condition

Question

IAM User has only one policy as below.
Object has Tag0:value tag.
So GetObject, GetObjectTagging, DeleteObjectTagging PutObjectTagging, GetObjectAcl requests returns 200 with this iam user credentials for this object but it returns 403 for same object for PutObject, PutObjectAcl, DeleteObject requests. It seems like a defect. 
{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "VisualEditor0",
            "Effect": "Allow",
            "Action": "s3:*",
            "Resource": "*",
            "Condition": {
                "StringEquals": {
                    "s3:ExistingObjectTag/Tag0": "value0"
                }
            }
        }
    ]
}

Steps to reproduce
1- Create a bucket
2- Upload an object to bucket
3- Add Tag0:value0 tag to object
4- Create an iam user
5- Attach above policy
6- Run GetObject and DeleteObject api requests for the object created on step 2. It will return 200 for GetObject but 403 for DeleteObject

re:Post Agent · Answer

This behavior is not a defect, but rather the expected outcome based on how the s3:ExistingObjectTag condition key works in IAM policies for Amazon S3.

The s3:ExistingObjectTag condition key applies only to operations that interact with existing objects and their tags. It does not apply to operations that create new objects or modify the object itself (rather than just its tags).

In your scenario:

1. Operations like GetObject, GetObjectTagging, DeleteObjectTagging, PutObjectTagging, and GetObjectAcl are successful (return 200) because they are operations that interact with an existing object or its tags. The policy allows these actions when the specified tag exists on the object.

2. Operations like PutObject, PutObjectAcl, and DeleteObject return a 403 (Access Denied) because:

- PutObject: This operation creates a new object, so the s3:ExistingObjectTag condition doesn't apply (there's no existing object to check tags on).
   - PutObjectAcl: This modifies the object's ACL, not its tags, so the condition doesn't apply.
   - DeleteObject: While this operates on an existing object, allowing this operation based solely on a tag could lead to unintended deletions. Amazon S3 requires more explicit permissions for delete operations.

To allow these operations, you would need to grant permissions using different condition keys or remove the condition entirely, depending on your security requirements.

If you need to allow all S3 actions including those that are currently denied, you might consider using a different approach to permissions or adding separate statements for those specific actions without the tag condition.

Remember, when using condition keys like s3:ExistingObjectTag, it's important to understand which operations they apply to and how they interact with different S3 actions to ensure your IAM policies provide the intended level of access.  
**Sources**  
[How Amazon S3 works with IAM - Amazon Simple Storage Service](https://docs.aws.amazon.com/AmazonS3/latest/userguide/security_iam_service-with-iam.html)  
[Troubleshoot IAM policies - AWS Identity and Access Management](https://docs.aws.amazon.com/IAM/latest/UserGuide/troubleshoot_policies.html)

Problem on s3:ExistingObjectTag Condition

Add your answer

Relevant content