modify s3 bucket with explicit deny

Question

Hi team,

I created an S3 bucket using CDK and initially added an explicit deny to the bucket policy with the following code:

```javascript
quarantineFilesBucket.addToResourcePolicy(
  new iam.PolicyStatement({
    effect: iam.Effect.DENY, // Deny all actions by default.
    actions: ["*"], // Deny all actions.
    resources: [
      quarantineFilesBucket.bucketArn,
      `${quarantineFilesBucket.bucketArn}/*`,
    ],
    principals: [new iam.AnyPrincipal()],
  })
);
```

Afterwards, I modified my CDK code to allow the `s3:ListBucket` action, but the pipeline failed due to the existing explicit deny that blocks all actions. Despite trying to perform actions through the AWS Console with admin access and using the AWS CLI with an admin role, I am still unable to make any changes to the bucket. I also attempted to remove the explicit deny from my CDK code and redeploy the stack, but the issue persists, and the pipeline continues to break.

I even tried to remove the bucket with Admin user access but cannot remove it.

how can i do in this case to fix my pipeline and add the policy to the bucket?

Thank you!

re:Post Agent · Answer

This is a common issue when working with S3 bucket policies, especially when an explicit deny is involved. An explicit deny takes precedence over any allow statements, even for users with administrative permissions. Here's how you can address this situation:

1. Use the AWS account root user: The root user of the AWS account has the ability to override explicit deny statements in resource-based policies. Log in to the AWS Management Console using the root credentials for the account that owns the S3 bucket.

2. Once logged in as the root user, navigate to the S3 console and locate the problematic bucket.

3. Select the bucket and go to the "Permissions" tab.

4. In the "Bucket policy" section, you should be able to edit or delete the existing policy that contains the explicit deny.

5. Remove the explicit deny statement or modify the policy to allow the necessary actions for your pipeline and other required operations.

6. Save the changes to the bucket policy.

After modifying or removing the problematic policy using the root user, you should be able to deploy your updated CDK stack successfully. Your pipeline should then be able to interact with the bucket as intended.

For future reference, when working with bucket policies, it's advisable to:

- Test new policies on non-critical resources first.
- Apply policies gradually and verify access after each change.
- Include exceptions in deny statements for necessary roles and users.
- Use allow statements instead of broad deny statements when possible.

Remember, while using the root user solves this immediate issue, it's generally recommended to use it sparingly and only for tasks that specifically require root access. For ongoing management, continue to use IAM users and roles with appropriate permissions.  
**Sources**  
[Deleting a S3 bucket with DENY all policies on it | AWS re:Post](https://repost.aws/questions/QU1jbgURnaQdqMzQanuqO1SQ/deleting-a-s3-bucket-with-deny-all-policies-on-it)  
[Explicit deny in a resource-based policy | AWS re:Post](https://repost.aws/questions/QUf23tnXNpRT-oXnlj3T8CEQ/explicit-deny-in-a-resource-based-policy)

modify s3 bucket with explicit deny

Add your answer

Relevant content