I have a Cognito pool / Federated identity setup with users receiving temporary IAM credentials via AWS Amplify. These users have access to getObject from a couple S3 buckets even though:
The buckets have all public access disabled
The buckets policy page is blank
The IAM role associated to the Cognito groups that these users are members of (Trust Relationship with cognito-identity.amazonaws.com) have no policies attached that grant any S3 permissions. Policies attached are only for AppSync, Cognito, and APIGateway
If I create a new bucket and point getObject at a contained object, the users get 403 Forbidden, an indication that some bucket-specific policy somewhere is granting access. Problem is we have so many policies and roles, many used in production, so I can't simply do on/off testing to narrow it down.
Is there a way somehow to trace what policy/role is providing access for a specific S3 getObject request?
EDIT I've run the IAM Policy Simulator for the role associated with the Cognito groups and it gives denied for the objects in question.
The objects I'm trying to have access correctly blocked for have no permissions set for them. The buckets have:
Block new public ACLs and uploading public objects (Recommended): True
Remove public access granted through public ACLs (Recommended): True
Block new public bucket policies (Recommended): True
Block public and cross-account access if bucket has public policies (Recommended): True
UPDATE I've added cloudtrail logging to my buckets. While an event with eventname = 'GetObject' is logged for any downloads I do from the bucket via console, no events are logged for s3.getObject downloads via the AWS javascript SDK. How can I get these events to log?
Use CloudTrail to log Amazon S3 API Calls.
An event logged in CloudTrail for S3 actions includes information about the requested action, the date and time of the action, request parameters, and the user identity, for example:
arn:aws:iam::123456789012:user/Alice
arn:aws:sts::123456789012:assumed-role/RoleToBeAssumed/MySessionName
Related
I have an IAM user that has full S3 access (i.e. can perform any S3 actions on any S3 resource within the AWS account). This user has created a bucket and put some files in it. The bucket has a policy which just contains an Allow rule that grants access to a different IAM user, in the same AWS account. Public access is turned off for the bucket.
Should the first user be able to access objects in this bucket? If so, is that because they created the bucket, or because they're in the account that owns the bucket? Is it possible to limit access to a bucket for users within the same AWS account?
S3 is one of the few services with resource policies, in this case they are called bucket policies.
A user in the same account has access to a (S3) resource if
nothing explicitly denies the access AND
either the bucket policy grants access OR the user / entity has a policy attached that grants access
If you wanted to restrict a bucket to a single user / entity you would
need to write a bucket policy that specifies that using a Deny statement for every user except the target one AND
either add a statement to the bucket policy or a policy attached to the user / entity granting access to the bucket.
The standard doc for understanding policy evaluation logic is this. There are other, more complicated ways to achieve your goal using e.g. permission boundaries and SCPs but they are probably overkill in your situation.
What method to list IAM User or Role that accessing Private S3 Buckets in Single account.
You can activate logging on the Amazon S3 bucket.
See: Logging requests using server access logging - Amazon Simple Storage Service
The logs include a field for Requester:
The canonical user ID of the requester, or a - for unauthenticated requests. If the requester was an IAM user, this field returns the requester's IAM user name along with the AWS root account that the IAM user belongs to. This identifier is the same one used for access control purposes.
i have tried several methods, couldn't succeed. I need to have policy that attach to users, so that they could see only public buckets not all the buckets in their aws console
The ability to view a list of buckets is granted via the s3:ListAllMyBuckets permission, which is defined as:
Grants permission to list all buckets owned by the authenticated sender of the request
Thus, the user either has permission to list the names of all buckets, or none of the buckets. It is not possible to filter which buckets are returned in the listing.
here is the scenario.
AWS accountA has an S3 bucket.
AWS acountB has cognito user pool and cognito identity set up.
Also accountB is running a amplify app (so there is a fixed origin url)
I want to allow logged users from accountB to put/get objects from bucket in AccountA.
How do I configure the bucket to allow that?
How do I configure the identity pool?
This is simple, the bucket would need to be updated to include a bucket policy that grants access to the role that the group in the identity pool uses.
Once this is done you would need to update the policy on the IAM role to grant access to the bucket referencing the actions and resources as if they're in your account.
Take a look at the How can I provide cross-account access to objects that are in Amazon S3 buckets? article to get in depth instructions for enabling cross account support for the S3 bucket.
I have been reading a number of docs and watched number of videos, but I am still very confused about IAM Roles and Bucket policies. Here is what confuses me:
1) I create a bucket. At that time I can make it public or keep it private. If I make it public, then anyone, or any Application, can "see" the objects in the bucket. I think the permissions can be set to add/delete/get/list objects in the bucket. If this is the case, then why do I ever need to add any IAM Role for S3 buckets, or, add any Bucket policy (???)
2) At the time I create a bucket, can I give very specific permissions to only certain users/applications/EC2 instances etc to all or part of the bucket? e.g. App1 on EC2-X can access subfolder A in bucket B1.
3) Coming to IAM Roles, an EC2 role that gives full S3 access- what does it mean? Full access to any bucket? How can I restrict an app running on an EC2 to only certain buckets, with only certain restricted permissions (see #2) above)? Do all Apps on the EC2 have full access to all buckets? At the time of creating a bucket, can the permissions be so set that an IAM Role can be overruled?
4) Finally, what do Bucket Policies do in addition to the above IAM Roles? e.g is 'AllowS3FullAccess' a "Bucket Policy", or an "IAM Policy"? Why differentiate between types of policies- policies are just that- they define some permissions/rules on some objects/resources,as I see it.
Thanks for any clarifications.
- a newcomer to AWS
I think you are confusing permissions for resources with IAM entities.
i) There are resources (S3 bucket, EC2 instances etc.) owned by the AWS account and these resources can be accessed by IAM users, IAM roles or other AWS Services (can be from same or different account)
ii) We manage who can access and their permission level with policies
iii) Policies can be identity based (attached to IAM user/group/role) or resource based (attached to S3 bucket, SNS topic)
iv) Resource based policy will have a Principal element but the identity based policies will not have that (because the attached IAM entity is the Principal)
v) Permissions start from default deny, allow overrides the default deny and an explicit deny overrides any allow
vi) Final access will be determined by combination of all policies
To answer your questions:
1> We cannot add (or attach) an IAM role with an S3 bucket. If you want your bucket should be public (which is not recommended but need to do it till some extent if it's in use for static website), then you can keep it public
2> It is not possible while creating the bucket. You have to do it after creating the bucket via IAM and/or S3 bucket policy
3> If an IAM role has AmazonS3FullAccess, the role can (Effect:Allow) call any S3 API (s3:) for any S3 resource (Resource:) in your account (provided they don't have cross account access).
If multiple applications run on an instance with an IAM role attached and are using credentials provided by the role, their permission will be same.
4> I don't know where you got the reference AllowS3FullAccess but we cannot confirm unless we know the exact JSON. If it is attached to a bucket or has the Principal element, it is a bucket policy.
You can use IAM and Bucket policies based on your need. Usually bucket policies are used for cross account access or if you want to manage S3 permission policies in a single place.