Skip to content

Policy - Acess to specific objects from bucket

0

have created an s3 bucket "abc" and added couple of folders "Yogesh" and "xyz". I have created an IAM user and added own policy as below. User should see all buckets and only xyz folder

Is it possible??

{ "Version": "2012-10-17", "Statement": [ { "Sid": "AllowUsersToSeeBucketList", "Action": [ "s3:ListAllMyBuckets", "s3:GetBucketLocation" ], "Effect": "Allow", "Resource": [ "arn:aws:s3:::" ] }, { "Sid": "AllowListingofSpecificFolder", "Action": [ "s3:ListBucket" ], "Effect": "Allow", "Resource": [ "arn:aws:s3:::xyz" ], "Condition": { "StringLike": { "s3:prefix": [ "abc/" ] } } }, { "Sid": "AllowAllActions", "Effect": "Allow", "Action": [ "s3:" ], "Resource": [ "arn:aws:s3:::xyz-abc/" ] } ] }

But If I try this policy the user can see buckets but not objects with error - Insufficient permissions to list objects After you or your AWS administrator has updated your permissions to allow the s3:ListBucket action, refresh the page. Learn more about Identity and access management in Amazon S3

asked a year ago346 views
1 Answer
2

Hello.

The IAM policy itself is correct.
However, when operating from the management console, an error occurs because it lists all objects in the bucket.
Although you can view objects in the target folder from the AWS CLI as shown below, we have confirmed that objects in other folders cannot be viewed.

aws s3 ls s3://bucket-name/abc/
EXPERT
answered a year ago
EXPERT
reviewed a year ago
EXPERT
reviewed a year ago
  • For example, you can open it from the management console by specifying the folder with the URL as shown below. Therefore, when operating from the management console, it is not possible to display only specific folders. If you are operating from the management console, you will need to specify the folder using the URL to access it.

    https://ap-northeast-1.console.aws.amazon.com/s3/buckets/bucket-name?region=ap-northeast-1&bucketType=general&prefix=abc/&showversions=false
    

You are not logged in. Log in to post an answer.

A good answer clearly answers the question and provides constructive feedback and encourages professional growth in the question asker.