Unable to delete S3 bucket - amazon-web-services

I created a s3 bucket using console, while configuration I removed the default selected user. Now when I am trying to delete the bucket using console it says access denied.
I understand I should have removed the user. However when I click on bucket name in permission it show owner: myUserName and bucket policy: no
How can I delete it?
As I understand there is owner but there is no permission to owner as I removed it while configuration.


You are not able to delete it because there is a deny effect on "s3:DeleteBucket" on all principals according to this thread
You can simply follow these steps -
Login as root user. (Not as any IAM user you might have specified)
Go to the S3 console.
Click on the bucket you want to delete.
Under the "Permissions" tab click on "Bucket Policy"
Click on "Delete"
Now you will be able to delete the bucket.
Incidentally, before you click on delete if you take a close look at the last element of the "Statement" array, you'll see what was causing the problem.


Delete bucket policy and you will be able to delete the bucket


You can try this in 2 ways:
First(Recommended): Delete the bucket policy and delete the bucket.
Second: Follow these steps
Create a new Bucket(Do not change anything, keep default).
Go to S3 console where all buckets are listed.
Select newly created bucket.
Click on permissions.
Copy the account id under owner access section.
Go to permissions of old bucket.
Add account using the copied account id.
Now try deleting it.


Better to delete that particular element of the statement array than to point blank delete everything.


I could not delete S3 resource that was created by Elastic Beanstalk
Bucket policy
Deleting S3 again and it worked


I successfully deleted my bucket by changing the "Action": "Deny" to "Action": "Allow" under permission tag

Related

Root user has no access to bucket policy

I have created a new S3 bucket and I am following the below tutorial to host a static website. https://docs.aws.amazon.com/AmazonS3/latest/userguide/HostingWebsiteOnS3Setup.html#step3-edit-block-public-access
However when it comes to setting the bucket policy, it states that the root user has no access to manage bucket policy. If I follow the links and traverse to the IAM console, there are no other users but me the root user. How can the root user grant himself the bucket permissions?

It wont allow setting a bucket policy if you have not cleared the Block All Public Access button. I had not cleared that and it was resulting in this invalid permissions error.

Bucket created by EBS (Elastic Beanstalk) cannot be deleted

I tried the Elastic Beanstalk(EBS) to practice my learning and quickly I deleted it. However, I see there is an S3 bucket created by this EBS service during its launch, is still existing though everything else (like Ec2) is deleted on its on while I deleted the EBS in my account. I want to delete this S3 too, but it gives error while deleting: "Insufficient permissions to delete bucket" After you or your AWS admin have updated your IAM permissions to allow s3:DeleteBucket, choose delete bucket. API response -Access Denied
I created EBS and deleted under my root account. I am still under my root account while trying to delete S3 but I get this error. Can someone pls advise, what I am missing here because I did not used any S3 Role as it points in its error message. Any help pls?

In the S3 dashboard, select the bucket you want to delete
Select the "Permissions" tab.
Navigate to the Bucket Policies & delete the policy
It is the bucket policy created by EB that denies its deletion.
Once the policy is deleted, you will be able to delete the bucket as well.

**
To delete the bucket created by Beanstalk we need to modify the attached bucket policy created by beanstalk as it denies the delete action.
To allow the delete action we can either modify the policy and allow
the delete action or the easy way is to directly delete/remove the
policy.
If you want to delete the policy using python code you can check the
example given below.
Note: The below python code will delete all the buckets from your account. You can modify the code if you want to delete any specific bucket. You can download the credentials needed from the IAM service
import boto3
# authenticate s3 = boto3.resource('s3',
aws_access_key_id='ACCESS_KEY',
aws_secret_access_key='SECRET_ACCESS',
)
bucket = 'bucket_name'
# delete policy if bucket is created by beanstalk
bucket.Policy().delete()
# delete object versions
bucket.object_versions.delete()
# delete all the objects inside the bucket
bucket.objects.all().delete()
# delete the bucket
bucket.delete()
print(bucket, ' deleted successfully!')

How to see policies for S3 buckets which showing `Access Denied` error in AWS Console?

I've logged into AWS account as root user. But I'm unable to access some of the buckets in AWS. They are not showing in the S3 Console. I've accessed them by submitting the bucket name in the url
For example let's call the bucket unaccessible-bucket
https://s3.console.aws.amazon.com/s3/buckets/unaccessible-bucket/?region=us-east-1&tab=overview
If I navigates to Permissions > Bucket Policy I'm seeing notice Access denied, I'm unable to download the files. I'm unable to change the policy. I've tried with AWS CLI also.
Can someone please tell me how to edit the policy.
As per our organisation requirement,
We have to add two new IAM users..
For one user...We have to grant access to all buckets including this unaccessible-bucket.
For other user...We have to grant access to only this unaccessible-bucket.
Please check the screenshot
Many Thanks.

Assuming that you are logged into the AWS Console as the root user.
If you cannot see an S3 bucket in the AWS console, then you do not own the bucket and it is owned by another account.
If you can see the bucket in the console then you own the bucket. If you cannot access the contents of the bucket then you will need to edit the S3 Bucket Policy and add the root user as a principal. Replace the account number with your own.
Add this statement (or modify) to your S3 Bucket Policy:
"Principal": { "AWS": "arn:aws:iam::123456789012:root" }

Amazon S3 File Permissions, Access Denied when copied from another account

I have a set of video files that were copied from one AWS Bucket from another account to my account in my own bucket.
I'm running into a problem now with all of the files where i am receiving Access Denied errors when I try to make all of the files public.
Specifically, I login to my AWS account, go into S3, drill down through the folder structures to locate one of the videos files.
When I look at this specificfile, the permissions tab on the files does not show any permissions assigned to anyone. No users, groups, or system permissions have been assigned.
At the bottom of the Permissions tab, I see a small box that says "Error: Access Denied". I can't change anything about the file. I can't add meta-data. I can't add a user to the file. I cannot make the file Public.
Is there a way i can gain control of these files so that I can make them public? There are over 15,000 files / around 60GBs of files. I'd like to avoid downloading and reuploading all of the files.
With some assistance and suggestions from the folks here I have tried the following. I made a new folder in my bucket called "media".
I tried this command:
aws s3 cp s3://mybucket/2014/09/17/thumb.jpg s3://mybucket/media --grants read=uri=http://acs.amazonaws.com/groups/global/AllUsers full=emailaddress=my_aws_account_email_address
I receive a fatal error 403 when calling the HeadObject operation: Forbidden.

A very interesting conundrum! Fortunately, there is a solution.
First, a recap:
Bucket A in Account A
Bucket B in Account B
User in Account A copies objects to Bucket B (having been granted appropriate permissions to do so)
Objects in Bucket B still belong to Account A and cannot be accessed by Account B
I managed to reproduce this and can confirm that users in Account B cannot access the file -- not even the root user in Account B!
Fortunately, things can be fixed. The aws s3 cp command in the AWS Command-Line Interface (CLI) can update permissions on a file when copied to the same name. However, to trigger this, you also have to update something else otherwise you get this error:
This copy request is illegal because it is trying to copy an object to itself without changing the object's metadata, storage class, website redirect location or encryption attributes.
Therefore, the permissions can be updated with this command:
aws s3 cp s3://my-bucket/ s3://my-bucket/ --recursive --acl bucket-owner-full-control --metadata "One=Two"
Must be run by an Account A user that has access permissions to the objects (eg the user who originally copied the objects to Bucket B)
The metadata content is unimportant, but needed to force the update
--acl bucket-owner-full-control will grant permission to Account B so you'll be able to use the objects as normal
End result: A bucket you can use!

aws s3 cp s3://account1/ s3://accountb/ --recursive --acl bucket-owner-full-control

To correctly set the appropriate permissions for newly added files, add this bucket policy:
[...]
{
"Effect": "Allow",
"Principal": {
"AWS": "arn:aws:iam::123456789012::user/their-user"
},
"Action": [
"s3:PutObject",
"s3:PutObjectAcl"
],
"Resource": "arn:aws:s3:::my-bucket/*"
}
And set ACL for newly created files in code. Python example:
import boto3
client = boto3.client('s3')
local_file_path = '/home/me/data.csv'
bucket_name = 'my-bucket'
bucket_file_path = 'exports/data.csv'
client.upload_file(
local_file_path,
bucket_name,
bucket_file_path,
ExtraArgs={'ACL':'bucket-owner-full-control'}
)
source: https://medium.com/artificial-industry/how-to-download-files-that-others-put-in-your-aws-s3-bucket-2269e20ed041 (disclaimer: written by me)

In case anyone trying to do the same but using Hadoop/Spark job instead of AWS CLI.
Step 1: Grant user in Account A appropriate permissions to copy
objects to Bucket B. (mentioned in above answer)
Step 2: Set the fs.s3a.acl.default configuration option using Hadoop Configuration. This can be set in conf file or in program:
Conf File:
<property>
<name>fs.s3a.acl.default</name>
<description>Set a canned ACL for newly created and copied objects. Value may be Private,
PublicRead, PublicReadWrite, AuthenticatedRead, LogDeliveryWrite, BucketOwnerRead,
or BucketOwnerFullControl.</description>
<value>$chooseOneFromDescription</value>
</property>
Programmatically:
spark.sparkContext.hadoopConfiguration.set("fs.s3a.acl.default", "BucketOwnerFullControl")

by putting
--acl bucket-owner-full-control
made it to work.

I'm afraid you won't be able to transfer ownership as you wish. Here's what you did:
Old account copies objects into new account.
The "right" way of doing it (assuming you wanted to assume ownership on the new account) would be:
New account copies objects from old account.
See the small but important difference? S3 docs kind of explain it.
I think you might get away with it without needing to download the whole thing by just copying all of the files within the same bucket, and then deleting the old files. Make sure you can change the permissions after doing the copy. This should save you some money too, as you won't have to pay for the data transfer costs of downloading everything.

boto3 "copy_object" solution :
Providing Grant control to the destination bucket owner
client.copy_object(CopySource=copy_source, Bucket=target_bucket, Key=key, GrantFullControl='id=<bucket owner Canonical ID>')
Get for console
Select bucket, Permission tab, "Access Control List" tab

Access Denied on AWS S3 bucket with no permission set up

In our S3 configuration we have a bucket that ended up without any permissions, which I reckon my colleague deleted.
Now, we cannot read this bucket, I cannot add permissions to it using the management console, selecting grantee and the permission, as it says "Sorry! You do not have permissions to view this bucket.", When I click on "Add Bucket policy", it opens the dialog which says "Loading" and it keeps loading forever.
I've tried to use aws s3 and aws s3api to grand permission and/or delete the bucket with no success.
I want to either delete this bucket or change it's permissions.
EDIT: We also noticed that the bucket has no owner.

In the Amazon S3 Management Console:
Select the bucket (don't click on its name, just click the line it is on)
Go to the Properties pane on the right
Expand the Permissions section
If there is no line displayed, click Add more permissions, then select the Grantee (possibly your account name?) and tick some permission boxes
These permissions are on the Bucket itself.
Permissions to list the contents of an Amazon S3 bucket are normally granted via Identity and Access Management (IAM) rather than a bucket policy. Traditionally, bucket policies are used to grant access to objects within a bucket.
From your description, it appears that there is no bucket policy in place, which is perfectly okay. All new buckets have no bucket policy anyway.
If the above fix doesn't work, you should check your permissions in IAM to see what you are permitted to do in Amazon S3:
Is there a policy granting you access to everything in S3 (s3:*), or at least a policy granting you access to this bucket?
Is there a policy that is explicitly denying access to this bucket? (Deny overrides Allow)