Terraform give IAM access to specific folder only in S3 - amazon-web-services

Question

How can I create an IAM user using terraform with access to one folder in s3
I found a lot of answers that give access to the entire bucket but I want access to one folder only
resource "aws_iam_policy" "username-s3-access" {
name = "username-s3-access"
path = "/"
policy = data.aws_iam_policy_document.username-s3-access.json
}
resource "aws_iam_user" "username-s3-access" {
name = "username-s3-access"
path = "/machine/"
}
resource "aws_iam_user_policy_attachment" "username-s3-access" {
user = aws_iam_user.username-s3-access.name
policy_arn = aws_iam_policy.username-s3-access.arn
}

Answer 1

I found the solution based on this official documentation in AWS site https://aws.amazon.com/premiumsupport/knowledge-center/s3-folder-user-access/
This code will give full assess to one folder in the bucket
scroll down to find the code for readonly access to one folder
Note: change the bucket_arn and the folder_name
variable "bucket_arn" {
type = string
default = "bucket_arn"
}
variable "folder_name" {
type = string
default = "s3_folder_name"
}
data "aws_iam_policy_document" "username-s3-access" {
statement {
sid = "AllowUserToSeeBuckets"
effect = "Allow"
resources = ["arn:aws:s3:::*"]
actions = [
"s3:ListAllMyBuckets",
"s3:GetBucketLocation",
]
}
statement {
sid = "AllowBucketListing"
effect = "Allow"
resources = [ var.bucket_arn ]
actions = ["s3:ListBucket"]
}
statement {
sid = "AllowFolderListing"
effect = "Allow"
resources = [ var.bucket_arn ]
actions = ["s3:ListBucket"]
condition {
test = "StringEquals"
variable = "s3:prefix"
values = [
"",
"${var.folder_name}"
]
}
condition {
test = "StringEquals"
variable = "s3:delimiter"
values = ["/"]
}
}
statement {
sid = "AllowAllS3ActionsInUserFolder"
effect = "Allow"
resources = ["${var.bucket_arn}/${var.folder_name}/*"]
actions = ["s3:*"]
}
}
resource "aws_iam_policy" "username-s3-access" {
name = "username-s3-access"
path = "/"
policy = data.aws_iam_policy_document.username-s3-access.json
}
resource "aws_iam_user" "username-s3-access" {
name = "username-s3-access"
path = "/machine/"
}
resource "aws_iam_user_policy_attachment" "username-s3-access" {
user = aws_iam_user.username-s3-access.name
policy_arn = aws_iam_policy.username-s3-access.arn
}
if you want to give read only access to the folder then replace the last statement
statement {
sid = "AllowReadOnlyInUserFolder"
effect = "Allow"
resources = ["${var.bucket_name}/${var.folder_name}/*"]
actions = [
"s3:GetObject",
"s3:ListBucket",
]
}