Handle S3 access policy for group team without IAM user

Hello,

You could create a role allowing federated users (via SSO) to assume it:

• Create an IAM role for the IT team that allows federated users from your SSO provider to assume it. The trust policy should specify that only users authenticated via SSO can access the role
• Attach an S3 access policy to this IT role, granting permissions to your quarantine bucket to retrieve objects inside it
• Configure a bucket policy on the quarantine bucket to restrict access exclusively to this role, ensuring that no other identities can access the quarantined files
• If the IT Security team needs access from another AWS account, update the trust policy of the IT role to allow cross-account access by specifying their AWS account ID

Hope it helps 😊

If you already connect to your AWS accounts using IAM Identity Center with your SSO (Azure AD), you basically just need to create or update your permission sets in IAM Identity Center.

For example, here there are 3 permission sets associate with this account : One for Billing Access Only, one for Read Only Access, and one for Administrator Access.

To create a specific quarantine bucket S3 access permission set named S3QuarantineBucketAccess, you need to attach a policy that grants the required permissions.
After that, you must associate the permission set with the necessary AWS accounts.
Create a permission set
Create a IAM Policy

If you prefer to use a bucket policy instead, create a permission set with no permissions (or use an existing one) and specify the ARN of the permission set in your bucket policy.
Referencing permission sets in resource policies

Given your constraints and requirements, there are several approaches you can consider to manage access control for the quarantine bucket without creating IAM users:

1. S3 Access Grants: This is a good option for granting granular access to specific S3 prefixes or buckets for users or groups from your corporate directory. When integrated with AWS IAM Identity Center (which works well with your SSO setup), you can grant read-only, write-only, or read-write access to the quarantine bucket directly to your IT Security team's group in your corporate directory. This approach eliminates the need to map users to IAM principals and simplifies auditing.

2. Cross-account access with AWS Organizations: If the IT Security team needs to access the quarantine bucket from another AWS account, you can use a combination of bucket policies and IAM roles. Create an IAM role in the account where the quarantine bucket resides, and use a bucket policy that allows access only to principals from your AWS Organization. The IT Security team can then assume this role from their account to access the quarantine bucket.

3. S3 Access Points: Create an S3 Access Point for the quarantine bucket with a policy that restricts access to specific federated identities or roles associated with your IT Security team. This provides a distinct network endpoint with its own access policy, allowing for more granular control.

4. VPC Endpoint Policy: If access to the quarantine bucket should only be allowed from specific VPCs, you can use a VPC Endpoint for S3 with a policy that restricts access to buckets within your organization. This can be combined with other access control methods for added security.

For any of these approaches, you'll want to use the principle of least privilege, granting only the necessary permissions (e.g., s3:GetObject, s3:PutObject) on the specific bucket or prefix required.

Remember to also implement additional security measures such as enabling S3 Versioning, using server-side encryption, and setting up access logging for the quarantine bucket to maintain a strong security posture.

Given that your team uses federated identities, you'll need to work with your identity provider to map the appropriate groups or roles to the AWS permissions. This mapping can be done through IAM Identity Center or your federated identity solution.

Lastly, consider implementing a notification system using Amazon SNS or Amazon EventBridge to alert the IT Security team when new objects are added to the quarantine bucket, rather than relying solely on email notifications from your application.
Sources
Managing access with S3 Access Grants - Amazon Simple Storage Service
Examples of Amazon S3 bucket policies - Amazon Simple Storage Service
Access control in Amazon S3 - Amazon Simple Storage Service
Secure access to S3 buckets outside an AWS Organization from VPCs | AWS re:Post