Accessing S3 bucket from a dedicated user ( policy failure ? ) - amazon-web-services

Question

I'm trying to create an S3 bucket with a dedicated user for upload/download using terraform.
For some reason the user that is being created is unable to access the bucket:
$ aws iam list-attached-user-policies --user-name csgoserver
{
"AttachedPolicies": [
{
"PolicyName": "AllowUsercsgoserverAccessTocsgofiles",
"PolicyArn": "arn:aws:iam::370179080679:policy/AllowUsercsgoserverAccessTocsgofiles"
}
]
}
$ aws s3 cp bucket.tf s3://csgofiles --profile test
upload failed: .\bucket.tf to s3://csgofiles/bucket.tf An error occurred (AccessDenied) when calling the PutObject operation: Access Denied
$ aws iam get-user-policy --user-name csgoserver --policy-name AllowUsercsgoserverAccessTocsgofiles
An error occurred (NoSuchEntity) when calling the GetUserPolicy operation: The user policy with name AllowUsercsgoserverAccessTocsgofiles cannot be found.
user.tf:
resource "aws_iam_user" "s3user" {
name = var.user_name
force_destroy = true
}
data "aws_iam_policy_document" "default" {
statement {
sid = "AllowUser${var.user_name}AccessTo${var.bucket_name}"
actions = ["s3:*"]
resources = ["arn:aws:s3:::${var.bucket_name}"]
effect = "Allow"
}
}
resource "aws_iam_user_policy" "s3user_policy" {
name = aws_iam_user.s3user.name
user = aws_iam_user.s3user.name
policy = join("", data.aws_iam_policy_document.default.*.json)
}
resource "aws_iam_access_key" "s3user_ak" {
user = aws_iam_user.s3user.name
}
There is one more thing I do not understand. The aws iam get-policy doesn't work on that policy:
$ aws iam list-policies --max-items 2
{
"Policies": [
{
"PolicyName": "AllowUsercsgoserverAccessTocsgofiles",
"PolicyId": "ANPAVMMDEQHTRE4NG3N2E",
"Arn": "arn:aws:iam::370179080679:policy/AllowUsercsgoserverAccessTocsgofiles",
"Path": "/",
"DefaultVersionId": "v1",
"AttachmentCount": 1,
"PermissionsBoundaryUsageCount": 0,
"IsAttachable": true,
"CreateDate": "2021-11-26T22:17:52+00:00",
"UpdateDate": "2021-11-26T22:17:52+00:00"
},
{
"PolicyName": "eks-full-access-policy",
"PolicyId": "ANPAVMMDEQHTR4C65WFT6",
"Arn": "arn:aws:iam::370179080679:policy/eks-full-access-policy",
"Path": "/",
"DefaultVersionId": "v1",
"AttachmentCount": 0,
"PermissionsBoundaryUsageCount": 0,
"IsAttachable": true,
"CreateDate": "2021-03-30T09:57:04+00:00",
"UpdateDate": "2021-03-30T09:57:04+00:00"
}
],
"NextToken": "eyJNYXJrZXIiOiBudWxsLCAiYm90b190cnVuY2F0ZV9hbW91bnQiOiAyfQ=="
}
$ aws iam get-policy --policy-arn arn:aws:iam::370179080679:policy/AllowUsercsgoserverAccessTocsgofile
An error occurred (NoSuchEntity) when calling the GetPolicy operation: Policy arn:aws:iam::370179080679:policy/AllowUsercsgoserverAccessTocsgofile was not found.
$ aws iam get-policy --policy-arn arn:aws:iam::370179080679:policy/eks-full-access-policy
{
"Policy": {
"PolicyName": "eks-full-access-policy",
"PolicyId": "ANPAVMMDEQHTR4C65WFT6",
"Arn": "arn:aws:iam::370179080679:policy/eks-full-access-policy",
"Path": "/",
"DefaultVersionId": "v1",
"AttachmentCount": 0,
"PermissionsBoundaryUsageCount": 0,
"IsAttachable": true,
"CreateDate": "2021-03-30T09:57:04+00:00",
"UpdateDate": "2021-03-30T09:57:04+00:00"
}
}

Answer 1

I don't think your IAM policy is valid.
You could use something similar to the below:
{
"Id": "Policy1638106306386",
"Version": "2012-10-17",
"Statement": [
{
"Sid": "Stmt1638106302079",
"Action": "s3:*",
"Effect": "Allow",
"Resource": "arn:aws:s3:::examplebucket",
"Principal": {
"AWS": [
"370179080679"
]
}
}
]
}
I would also suggest putting the policy inline in your aws_iam_user_policy resource rather than using a data source.
And looking at the documentation it does seem policy is a required field within the aws_iam_user_policy resource.
https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_user_policy
Maybe like the below:
resource "aws_iam_user_policy" "s3user_policy" {
name = aws_iam_user.s3user.name
user = aws_iam_user.s3user.name
policy = jsonencode ({
"Version": "2012-10-17",
"Statement": [
{
"Sid": "Stmt1638106302079",
"Action": "s3:*",
"Effect": "Allow",
"Resource": "arn:aws:s3:::examplebucket/*",
}
]
})

Answer 2

I was missing two characters in the Resource key at the end /* ...
data "aws_iam_policy_document" "default" {
statement {
sid = "AllowUser${var.user_name}AccessTo${var.bucket_name}"
actions = ["s3:*"]
resources = ["arn:aws:s3:::${var.bucket_name}/*"]
effect = "Allow"
}
}