{"id":11790,"date":"2014-02-24T18:15:14","date_gmt":"2014-02-24T12:45:14","guid":{"rendered":"https:\/\/2thenew.online\/blog\/?p=11790"},"modified":"2014-02-24T18:16:39","modified_gmt":"2014-02-24T12:46:39","slug":"s3-bucket-permission","status":"publish","type":"post","link":"https:\/\/2thenew.online\/blog\/s3-bucket-permission\/","title":{"rendered":"S3 Bucket Permission"},"content":{"rendered":"
\n

Amazon’s Simple Storage Service (S3) allows its customer to maintain full control over who has access to their data with the help of its Identity Access Management (IAM) service and S3 bucket policies. For example, using Bucket Permission, one can give only reading access to one user, whereas using same permission\/policy options, he can allow another user to read and write both.<\/p>\n

We faced a similar requirement on a project a few days back, where a particular user required permission to upload files and make them publicly readable. To meet those requirements, I followed below mentioned steps, which are:<\/p>\n

Create an IAM user and give read only access to use S3 resources.<\/p>\n

Your user permission should be like:<\/p>\n<\/div>\n

[shell]{
\n"Version": "2012-10-17",
\n "Statement": [
\n {
\n "Effect": "Allow",
\n "Action": [
\n "s3:Get*",
\n "s3:List*"
\n ],
\n "Resource": "*"
\n }
\n ]
\n}[\/shell]<\/p>\n

Now create a bucket and add the following policy to S3 bucket.<\/p>\n

[shell]{
\n "Version":"2008-10-17",
\n "Id":"Policy1391686183873",
\n "Statement":[
\n {
\n "Sid":"Stmt1391686181884",
\n "Effect":"Allow",
\n "Principal":{
\n "AWS":"*"<\/p>\n

},
\n "Action":"s3:GetObject",\u00a0\u00a0\u00a0\u00a0\u00a0\/\/ actions allowed, only allowed to fetch object.
\n "Resource":"arn:aws:s3:::<BucketName>\/*"\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 \u00a0\/\/Change\u00a0bucket\u00a0name\u00a0with\u00a0your\u00a0bucket
\n },
\n {
\n "Sid":"Stmt1391686181885",
\n "Effect":"Allow",
\n "Principal":{
\n "AWS":"arn:aws:iam::221312312:user\/<UserName>"\u00a0 \u00a0\/\/arn:aws:iam::accountnumber:role\/rolename
\n },<\/p>\n

"Action":"s3:PutObject", \u00a0\u00a0\/\/ actions allowed, only allowed to create object.
\n "Resource":"arn:aws:s3:::<BucketName>\/*"\u00a0 \u00a0\/\/Change\u00a0bucket\u00a0name\u00a0with\u00a0your\u00a0bucket
\n }
\n ]
\n}[\/shell]<\/p>\n

Note:<\/strong> Before using the policy remove the comments.<\/p>\n

Now if you upload any file, it will be publicly readable.<\/p>\n

Many a times customers are required to render public access of buckets in Amazon S3. Moreover, I would not recommend to go for it unless it becomes a requisite. Its better to go for safer and secure alternatives. Despite having flexibility and an architecture to support it, its encouraged to go for better security designs and go for full security review than direct bucket permissions.<\/div>\n
<\/div>\n
<\/div>\n
<\/div>\n<\/div>\n","protected":false},"excerpt":{"rendered":"

Amazon’s Simple Storage Service (S3) allows its customer to maintain full control over who has access to their data with the help of its Identity Access Management (IAM) service and S3 bucket policies. For example, using Bucket Permission, one can give only reading access to one user, whereas using same permission\/policy options, he can allow […]<\/p>\n","protected":false},"author":90,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"iawp_total_views":6,"footnotes":""},"categories":[7],"tags":[248,1332,670,1329,1330,1331],"class_list":["post-11790","post","type-post","status-publish","format-standard","hentry","category-grails","tag-aws","tag-aws-s3","tag-s3","tag-s3-permissions","tag-s3-policies","tag-s3-roles"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t