AWS Transfer Family - SFTP File Downloading Issue

Question

I have the below Policy for SFTP users, Customer wants WRITE and LIST without GET.   Using the below policy, still I can download the file. Can you please give me some suggestion about this.

{
    "Statement": [
        {
            "Action": [
                "s3:ListBucket",
                "s3:GetBucketLocation"
            ],
            "Effect": "Allow",
            "Resource": "arn:aws:s3:::mybucket",
            "Sid": "AllowListingOfUserFolder"
        },
        {
            "Action": [
                "s3:GetObject"
            ],
            "Effect": "Allow",
            "Resource": [
                "arn:aws:s3:::mybucket/*"
            ],
            "Sid": "InboundDirObjectAccess"
        },
        {
            "Action": [
                "s3:PutObject",
                "s3:GetObject"
            ],
            "Effect": "Allow",
            "Resource": [
                "arn:aws:s3:::mybucket/*/*/folder1/*",
                "arn:aws:s3:::mybucket/*/*/folder2/*"
            ],
            "Sid": "InboundDirObjectDenyobject"
        },
        {
            "Action": "s3:PutObject",
            "Condition": {
                "StringLikeIfExists": {
                    "s3:delimiter": [
                        "/"
                    ]
                }
            },
            "Effect": "Deny",
            "Resource": "arn:aws:s3:::mybucket/*/",
            "Sid": "DenyCreattionFolder"
        }
    ]
}

Accepted Answer

Thanks @Steve_M It's works

Answer

Firstly, please edit your question to remove the bucket name (obfuscate it and call it something like **mybucket** instead).

Looking at the actions in the policy and cross-referencing with to https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazons3.html#amazons3-actions-as-permissions

- `"Action": [ "s3:ListBucket"` grants permission to list some or all of the objects in an Amazon S3 bucket (which is what you want for the LIST)
- `"Action": [ "s3:PutObject"` grants permission to add an object to a bucket (which I think you may also want for WRITE)
- `"Action": [ "s3:GetObject"` grants permission to retrieve objects from Amazon S3 (which you don't want for GET)

Consider amending the policy to remove the **GetObject** permission.

Answer

if I remove "Action": [ "s3:GetObject" , in that case SFTP user of Transfer Family, Cannot connect with directory.

AWS Transfer Family - SFTP File Downloading Issue

Relevant content