IAM how to give access to list certain buckets

Question

HI folks,

I feel like this should be super simple, but I think i have everything enabled as it should be.

I have a user, to whom I've given a policy like:
```
{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "VisualEditor0",
            "Effect": "Allow",
            "Action": [
                "s3:*"
            ],
            "Resource": [
                "arn:aws:s3:::my-bucket",
                "arn:aws:s3:::my-bucket/*"
            ]
        }
    ]
}
```
However, he cannot see the bucket in the bucket list view. No buckets are listed. I would think, since I've given the user the action `s3*` for that bucket, they should be able to see that bucket listed. Am I wrong?

Cheers.

Answer

What you've done is fine for accessing the bucket.  But to have the S3 Console working properly they need  "s3:GetBucketLocation", "s3:ListAllMyBuckets" allowed.

Answer

Check for a bucket policy that is blocking access. Or an SCP. You can investigate using the [Policy Simulator](https://policysim.aws.amazon.com/home/index.jsp?#). Make sure to fill out the Resource in the simulator.

Answer

Hello!

Granting the s3:* permission to a user allows them to perform any action on the S3 bucket and its objects, but it does not necessarily grant them the permission to list the bucket. To list the buckets, the user needs the s3:ListAllMyBuckets permission.

To grant the s3:ListAllMyBuckets permission to the user, you can add a statement to their policy like this:

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "VisualEditor0",
            "Effect": "Allow",
            "Action": [
                "s3:ListAllMyBuckets"
            ],
            "Resource": "*"
        },
        {
            "Sid": "VisualEditor1",
            "Effect": "Allow",
            "Action": [
                "s3:*"
            ],
            "Resource": [
                "arn:aws:s3:::my-bucket",
                "arn:aws:s3:::my-bucket/*"
            ]
        }
    ]
}

Note that granting the s3:ListAllMyBuckets permission allows the user to list all the S3 buckets in your AWS account, so make sure to review and restrict the user's access as needed.

Let me know if that answered your question

IAM how to give access to list certain buckets

Relevant content