I have a problem with S3 backup, using AWS Backup tool.
I want to have S3 bucket backed up but I am receiving Access Denied error all the time.
I am quite sure, that the problem is with the bucket policy, cause when I delete the policy backup works like it should.
This is my current policy:
{
"Version": "2012-10-17",
"Id": "Policy1558438618388",
"Statement": [
{
"Sid": "Stmt1558438593926",
"Effect": "Deny",
"Principal": "*",
"Action": "s3:*",
"Resource": "arn:aws:s3:::<bucket-name-here>",
"Condition": {
"NotIpAddress": {
"aws:SourceIp": [
"<some-ip-address>/32",
"<some-ip-address>/32",
"<some-ip-address>/32",
"<some-ip-address>/32"
]
},
"ArnNotEquals": {
"aws:username": [
"arn:aws:iam::<some-user-arn>",
"arn:aws:iam::<some-user-arn>",
"arn:aws:iam::<some-user-arn>",
"arn:aws:iam::<some-user-arn>"
]
}
}
}
]
}
I can't figure it out using AWS docs what should I add here in that policy as a condition, to allow AWS Backup tool doing it's job?
As I said before, When I delete the policy everything works fine.
Related
I'm trying to grant read only access for CloudFormation to some templates in a S3 Bucket.
I can do this when CF in the same account as the S3 bucket using aws:PrincipalIsAWSService. However, when I try to get this to work for any Child Accounts, I get permission denied. I've tried adding the PrincipalOrgID or the Org account - but no joy so far.
I'm trying to avoid having to list ALL the child accounts, as they get added frequently, and was under the impression PrincipalOrgID was for this very purpose.
Any ideas?
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Principal": "*",
"Action": "s3:GetObject",
"Resource": [
"arn:aws:s3:::my-bucket",
"arn:aws:s3:::my-bucket/*"
],
"Condition": {
"StringEquals": {
"aws:PrincipalOrgID": "o-yyyyyyyyyy"
},
"Bool": {
"aws:PrincipalIsAWSService": "true"
}
}
}
Moving from comment to answer for visibility:
Problem was combination of conditions.
"StringEquals": {
"aws:PrincipalOrgID": "o-yyyyyyyyyy"
},
"Bool": {
"aws:PrincipalIsAWSService": "true"
}
Just leaving
"StringEquals": {
"aws:PrincipalOrgID": "o-yyyyyyyyyy"
}
enables other accounts from the organization to access it.
I have created an IAM role and attached it to an instance, would like anyone who logs into this instance to be able to upload, download and list the files in an s3 bucket with ACL enabled. mv and cp works but with aws s3 ls I get an error: A client error (AccessDenied) occurred when calling the ListBuckets operation: Access Denied
I am guessing there is something wrong with the way I use the ls command (since we now have ACL enabled). My IAM policy is below, can someone please shed some light on this? Thank you
{
"Version": "2012-10-17",
"Statement": [
{
"Sid": "statement1",
"Effect": "Allow",
"Action": "s3:*",
"Resource": [
"arn:aws:s3:::awsexamplebucket1/*"
],
"Condition": {
"StringEquals": {
"s3:x-amz-acl": "bucket-owner-full-control"
}
}
}
]
}
The ListBucket permission needs to be specified on the actual bucket itself, and not the items inside of it.
You'll need to create two separate Statements in your IAM policy: one which applies to the bucket itself (s3:ListBucket) and another which applies to the items inside the bucket only (s3:*).
Structure your IAM policy like so:
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": ["s3:ListBucket"],
"Resource": ["arn:aws:s3:::awsexamplebucket1"],
"Condition": {
"StringEquals": {
"s3:x-amz-acl": "bucket-owner-full-control"
}
}
},
{
"Effect": "Allow",
"Action": ["s3:*"],
"Resource": ["arn:aws:s3:::awsexamplebucket1/*"],
"Condition": {
"StringEquals": {
"s3:x-amz-acl": "bucket-owner-full-control"
}
}
}
]
}
See this page in the AWS documentation for a related example.
I have a Bucket Policy (listed below) that is supposed to prevent access to an S3 bucket when accessed from anywhere other than a specific VPC. I launched an EC2 instance in the VPC, tested and confirmed that S3 access works fine. Now, when I access the same S3 bucket over web console, I get 'Error - Access Denied' message.
Does this mean that aws:SourceVpc condition key is present in the request context when interacting with S3 over web console as well?
My assumption is that it is present in the request context as otherwise policy statement would have failed such that the statement's "Effect" does not apply because there is no "Ifexists" added to StringNotEquals - Asking this question as I could not find this information in AWS Documentation. Even after adding "Ifexists" to StringNotEquals, results are same - can someone confirm?
{
"Version": "2012-10-17",
"Id": "Policy1589385141624",
"Statement": [
{
"Sid": "Access-to-specific-VPC-only",
"Effect": "Deny",
"Principal": "*",
"Action": "s3:*",
"Resource": [
"arn:aws:s3:::abhxy12bst3",
"arn:aws:s3:::abhxy12bst3/*"
],
"Condition": {
"StringNotEquals": {
"aws:sourceVpc": "vpc-0xy915sdfedb5667"
}
}
}
]
}
Yes, you are right. I tested the following bucket policy, the operations from the AWS S3 console are denied.
{
"Version": "2012-10-17",
"Id": "Policy1589385141624",
"Statement": [
{
"Sid": "Access-to-specific-VPC-only",
"Effect": "Deny",
"Principal": "*",
"Action": "s3:*",
"Resource": [
"arn:aws:s3:::abhxy12bst3",
"arn:aws:s3:::abhxy12bst3/*"
],
"Condition": {
"StringLike": {
"aws:sourceVpc": "vpc-30*"
}
}
}
]
}
It means there is definitely some vpc id present in the request. It might be same for each account or it could be different.
This will apply to all requests interacting with S3. The console just provides a GUI on top of the AWS API.
I am performing Amazon Athena queries on an S3 bucket. Let's call it athena-bucket. Today I got a requirement to restrict this bucket over VPC Enpoints. So I have tried this S3 bucket policy:
{
"Version": "2012-10-17",
"Statement": [
{
"Sid": "VPCe and SourceIP",
"Effect": "Deny",
"NotPrincipal": {
"AWS": [
"arn:aws:iam::**********:user/user_admin",
"arn:aws:iam::**********:root",
]
},
"Action": "s3:*",
"Resource": [
"arn:aws:s3:::athena-bucket",
"arn:aws:s3:::athena-bucket/abc/*"
],
"Condition": {
"StringNotEquals": {
"aws:sourceVpce": [
"vpce-XXXXxxxxe",
"vpce-xxxxxxxxxx",
"vpce-XXXXXXXXXXXXXX"
]
},
"NotIpAddress": {
"aws:SourceIp": [
"publicip/32",
"publicip2/32"
]
}
}
}
]
}
Please note that Athena has full permission to access the above bucket. I want to use the S3 bucket policy to restrict access from only certain IP addresses and VPC Endpoint.
However, I am getting access denied error although request is routed through VPC Endpoints mentioned in the policy.
Amazon Athena is an Internet-based service. It accesses Amazon S3 directly and does not connect via an Amazon VPC.
If you restrict the bucket to only be accessible via a VPC Endpoint, Amazon Athena will not be able to access it.
There is actually a solution for you to get what you are asking for. The following policy condition allows actions from all of your VPC endpoints and Athena:
{
"Version": "2012-10-17",
"Statement": [
{
"Sid": "VPCe and SourceIP",
"Effect": "Deny",
"NotPrincipal": {
"AWS": [
"arn:aws:iam::**********:user/user_admin",
"arn:aws:iam::**********:root",
]
},
"Action": "s3:*",
"Resource": [
"arn:aws:s3:::athena-bucket",
"arn:aws:s3:::athena-bucket/abc/*"
],
"Condition": {
"ForAllValues:StringNotEquals": {
"aws:sourceVpce": [
"vpce-XXXXxxxxe",
"vpce-xxxxxxxxxx",
"vpce-XXXXXXXXXXXXXX"
],
"aws:CalledVia": [ "athena.amazonaws.com" ]
}
}
}
]
}
The "ForAllValues" portion of the condition is what turns this AND condition into an OR.
Not sure how your IP restrictions would play with this, since you cannot tell which IPs Athena would be coming from.
we are using Amazon S3 services and bucket for storing our data, now I have a problem, everything is working, but I want to restrict Delete object permissions only on few tables inside bucket, somehow this is not working:
{
"Version": "2012-10-17",
"Statement": [
{
"Sid": "Stmt1448899531000",
"Effect": "Allow",
"Action": [
"s3:Get*",
"s3:Put*",
"s3:List*"
],
"Resource": [
"*"
]
},
{
"Sid": "Stmt1461061827000",
"Effect": "Allow",
"Action": [
"s3:DeleteObject"
],
"Resource": [
"arn:aws:s3:::cf-templates-11e3g59cf34bh-eu-west-1/report_file_html/*",
"arn:aws:s3:::cf-templates-11e3g59cf34bh-eu-west-1/market_intelligence_result_sets/*"
]
}
]
}
I checked the ARN for bucket and it is "arn:aws:s3:::cf-templates-11e3g59cf34bh-eu-west-1" as excpected, market_intelligence and report_file_html tables also exist in the bucket, so I want to limit delete object action only to these tables,but from my PHP app, I get 403 error, permission denied to delete an object.
Using Amazon IAM Policy Validator, these rules validates successfully, but then using aws CLI, I get access denied error when calling DeleteObject.