Amazon S3 Bucket Policy not working as expected - amazon-web-services

Question

I am trying limit a bucket access to be accessible by only one Cognito user.
I tried this policy but it's not working
{
Version: '2012-10-17',
Statement: [
{
Sid: 'AllowCognitoUserAccess',
Effect: 'Allow',
Principal: '*',
Action: ['s3:PutObject', 's3:GetObject'],
Resource: 'arn:aws:s3:::testbucketoz123/*',
Condition: {
StringEquals: {
'aws:PrincipalTag/CognitoIdentityId':
'099702b2-0c2e-42ce-8e27-3012ab6032ad',
},
},
},
{
Sid: 'AllowCognitoUserAccess',
Effect: 'Allow',
Principal: '*',
Action: ['s3:ListBucket'],
Resource: 'arn:aws:s3:::testbucketoz123',
Condition: {
StringEquals: {
'aws:PrincipalTag/CognitoIdentityId':
'099702b2-0c2e-42ce-8e27-3012ab6032ad',
},
},
},
],
};
I think there's an issue in the condition, I am trying to check if the user's Identity ID is equal to 099702b2-0c2e-42ce-8e27-3012ab6032ad
If yes then grant this user access.
What I am expecting is to allow the user that has Identity ID equal to 099702b2-0c2e-42ce-8e27-3012ab6032ad to access the S3 bucket but it not working.
Is there anything wrong with the condition?
I suspect that this condition could only be applied to IAM users and not Cognito users, anyone can confirm that?

Answer 1

If your CognitoIdentityId is the sub claim, use the "Access Policies" example from Understanding Amazon Cognito Authentication Part 3: Roles and Policies
{
Sid: 'AllowCognitoUserAccess',
Effect: 'Allow',
Principal: '*',
Action: ['s3:PutObject', 's3:GetObject'],
Resource: 'arn:aws:s3:::testbucketoz123/*',
Condition: {
StringEquals: {
'"cognito-identity.amazonaws.com:sub":
"us-east-1:099702b2-0c2e-42ce-8e27-3012ab6032ad"
},
},
}
Otherwise check that the Identity pool attribute mapping has your "Identity ID" mapped to CognitoIdentityId and you set up a trust policy on that authenticated role allows for "sts:TagSession" so the aws:PrincipalTag is valued.
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Principal": {
"Federated": "cognito-identity.amazonaws.com"
},
"Action": [
"sts:AssumeRoleWithWebIdentity",
"sts:TagSession"
],
"Condition": {
"StringEquals": {
"cognito-identity.amazonaws.com:aud": "{your Identity pool ID}"
},
"ForAnyValue:StringLike": {
"cognito-identity.amazonaws.com:amr": "authenticated"
}
}
}
]
}