why s3:PutEncryptionConfiguration action is not being allowed for buckets with ResourceTag?

Question

I want IAM users to only edit resources that has tag CreatedBy as the IAM username.
My IAM policy looks like this

```
{
            "Sid": "AllowS3WriteActionsWithResourceTag",
            "Effect": "Allow",
            "Action": [
                "s3:Abort*",
                "s3:Associate*",
                "s3:Bypass*",
                "s3:Create*",
                "s3:Delete*",
                "s3:Dissociate*",
                "s3:Initiate*",
                "s3:ObjectOwnerOverrideToBucketOwner",
                "s3:Pause*",
                "s3:Put*",
                "s3:Replicate*",
                "s3:Restore*",
                "s3:Submit*",
                "s3:Update*",
                "s3vectors:Create*",
                "s3vectors:Put*",
                "s3vectors:Delete*",
                "s3tables:Create*",
                "s3tables:Put*",
                "s3tables:Delete*",
                "s3express:Create*",
                "s3express:Put*",
                "s3express:Delete*"
            ],
            "Resource": [
                "arn:aws:s3:*:*:accesspoint/*",
                "arn:aws:s3:*:*:accesspoint/*/object/*",
                "arn:aws:s3::*:accesspoint/*",
                "arn:aws:s3:::*",
                "arn:aws:s3:*:*:job/*",
                "arn:aws:s3:*:*:storage-lens/*",
                "arn:aws:s3:*:*:storage-lens-group/*",
                "arn:aws:s3:*:*:access-grants/default",
                "arn:aws:s3:*:*:access-grants/default/location/*",
                "arn:aws:s3:*:*:access-grants/default/grant/*",
                "arn:aws:s3express:*:*:bucket/*",
                "arn:aws:s3express:*:*:accesspoint/*",
                "arn:aws:s3tables:*:*:bucket/*",
                "arn:aws:s3vectors:*:*:bucket/*",
                "arn:aws:s3-object-lambda:*:*:accesspoint/*",
                "arn:aws:glacier:*:*:vaults/*",
                "arn:aws:s3-outposts:*:*:outpost/*",
                "arn:aws:s3-outposts:*:*:outpost/*/bucket/*",
                "arn:aws:s3-outposts:*:*:accesspoint/*"
            ],
            "Condition": {
                "StringEquals": {
                    "aws:ResourceTag/CreatedBy": "${aws:username}"
                }
            }
        }
```
s3:Put* includes the action s3:PutEncryptionConfiguration and "arn:aws:s3:::*" resource includes the bucket, why is this not being allowed, there are no explicit denies.
Docs say the action requires the bucket resource and then bucket resource supports aws:ResourceTag/.
If my bucket is tagged CreatedBy as my IAM username why is it not being allowed?

Riku_Kobayashi · Answer

Hello.

See the "PutEncryptionConfiguration" row in the table in the documentation below.  
I think it cannot be used because "aws:ResourceTag" is not listed in the "Condition keys" column of the "PutEncryptionConfiguration" line.  
https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazons3.html#amazons3-bucket

Shahed Kazi (@shajam) · Answer

You can try setting up a bucket policy instead. This bucket policy enforce username ownership.

```
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "AllowEncryptionChangeByCreator",
      "Effect": "Allow",
      "Principal": "*",
      "Action": "s3:PutEncryptionConfiguration",
      "Resource": "arn:aws:s3:::my-bucket",
      "Condition": {
        "StringEquals": {
          "aws:PrincipalTag/CreatedBy": "${aws:username}"
        }
      }
    }
  ]
}
```

why s3:PutEncryptionConfiguration action is not being allowed for buckets with ResourceTag?

Add your answer

Relevant content