Restrict viewing/listing objects in S3 with a specific prefix - amazon-web-services

Question

I've got a bucket policy to restrict roles (apart from one) from downloading/putting objects of a specific name into my S3 bucket.
However I'm having difficulty restricting the file from even being viewed if the file is there.
I would like to restrict roles from even listing files in the bucket with a prefix of 'audit'. I would still like them to be able to list all other objects in the path.
So far I've tried a few variations of this bucket policy. The role ID is for the role that should be able to view the files
- Sid: 3
Effect: Deny
Principal: "*"
Action:
- s3:ListBucket
Resource:
- arn:aws:s3:::my-bucket/audit*
Condition:
StringNotLike:
aws:userid:
- <THE ALLOWED ROLE ID>:*
I'm getting the following error:
Action does not apply to any resource(s) in statement
(Service: Amazon S3; Status Code: 400;
Error Code: MalformedPolicy; Request ID:
Thank you 😊

Answer 1

You can use aws:PrincipalArn condition to check for the IAM ARN.
Works with ARN operators and string operators.
Use this key to compare the Amazon Resource Name (ARN) of the principal that made the request with the ARN that you specify in the policy. For IAM roles, the request context returns the ARN of the role, not the ARN of the user that assumed the role. To learn which types of principals you can specify in this condition key, see Specifying a principal.
Availability – This key is always included in the request context.
{
"Statement": [
{ "Sid": "1",
"Effect": "Deny",
"Principal": "*",
"Action": [
"s3:ListBucket"
],
"Condition": {
"ArnNotLike": {
"aws:PrincipalArn": [
"arn:aws:iam::1234567890:role/myrole"
]
}
},
"Resource": [
"arn:aws:s3:::my-bucket"
]
}
]
}
Now why it is saying invalid policy because s3:ListBucket permission deals with bucket, not at the object level, so you are getting the error.
s3:GetObject applies to the objects in the bucket so the Resource is correct:
"Resource": "arn:aws:s3:::my-bucket/*".
s3:ListBucket applies to the Bucket itself and so the Resource should be
"Resource": "arn:aws:s3:::my-bucket"