S3 Policy for GetObject+PutObject in subfolders - amazon-web-services

Question

I have a folder structure in an s3 bucket (my-bucket) like this:
/folder1/
/folder2/subfolder/
/folder3/subfolder/subsubfolder/
file.ext
file2.ext
etc...
I want to be able to list, put and get all folders and objects in the root of the bucket and any subfolder (and subfolder of subfolder).
Here is my current policy for the user group that needs these permissions:
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": "s3:ListBucket",
"Resource": [
"arn:aws:s3:::my-bucket"
]
},
{
"Effect": "Allow",
"Action": "s3:GetObject",
"Resource": [
"arn:aws:s3:::my-bucket/*"
]
},
{
"Effect": "Allow",
"Action": "s3:PutObject",
"Resource": [
"arn:aws:s3:::my-bucket/*"
]
},
{
"Effect": "Allow",
"Action": [
"s3:ListAllMyBuckets",
"s3:List*"
],
"Resource": "arn:aws:s3:::*"
}
]
}
Using this policy I can only get and put objects in the root of the bucket. But I also want to get and put objects into the folders within the bucket. These folder names are dynamic so I cannot have them in the policy. How do I do this? I know with S3 full access policy it work but not with my example on above. I just keep on getting Access Denied error when trying this.
Any help would be appreciated.

Answer 1

The full policy would look something like this. This works from AWS S3 console.
Notice, that I didn't add s3:DeleteObject. If you need that as well don't forget to add it besides s3:PutObject and s3:GetObject.
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": "s3:ListBucket",
"Resource": "arn:aws:s3:::my-bucket"
},
{
"Effect": "Allow",
"Action": "s3:ListAllMyBuckets",
"Resource": "*"
},
{
"Effect": "Allow",
"Action": [
"s3:PutObject",
"s3:GetObject"
],
"Resource": "arn:aws:s3:::my-bucket/*"
}
]
}