White list S3 resources by extensions - amazon-web-services

Question

Struggling to create a bucket policy to white list certain file types. Specifically, I want to allow only image types to be accessible.
I was able to create a blacklist policy like so:
{
"Version": "2012-10-17",
"Statement": [
{
"Action": [
"s3:GetObject"
],
"Effect": "Deny",
"Resource": [
"arn:aws:s3:::[my_bucket]/*.exe"
],
"Principal": {
"AWS": "*"
}
}
]
}
WHITELIST ATTEMPT #1:
Problem: this allows all types, not just those listed
{
"Version": "2012-10-17",
"Statement": [
{
"Action": [
"s3:GetObject"
],
"Effect": "Allow",
"Resource": [
"arn:aws:s3:::[my_bucket]/*.jpg",
"arn:aws:s3:::[my_bucket]/*.png",
"arn:aws:s3:::[my_bucket]/*.gif",
],
"Principal": {
"AWS": "*"
}
}
]
}
WHITELIST ATTEMPT #2:
Problem: this ends up denying all files
{
"Version": "2012-10-17",
"Statement": [
{
"Action": [
"s3:GetObject"
],
"Effect": "Deny",
"Resource": [
"arn:aws:s3:::[my_bucket]/*"
],
"Principal": {
"AWS": "*"
}
},
{
"Action": [
"s3:GetObject"
],
"Effect": "Allow",
"Resource": [
"arn:aws:s3:::[my_bucket]/*.jpg",
"arn:aws:s3:::[my_bucket]/*.png",
"arn:aws:s3:::[my_bucket]/*.gif",
],
"Principal": {
"AWS": "*"
}
}
]
}

Answer 1

Your whitelist bucket policy #1 is correct. The reason it is allowing all file types could be your IAM policy allows all file types for the user. Make sure the IAM policy attached to the user does not have S3FullAccess
In accordance with the principle of least-privilege, decisions default
to DENY and an explicit DENY always trumps an ALLOW. For example, if
an IAM policy grants access to an object, the S3 bucket policies
denies access to that object, and there is no S3 ACL, then access will
be denied. Similarly, if no method specifies an ALLOW, then the
request will be denied by default. Only if no method specifies a DENY
and one or more methods specify an ALLOW will the request will be
allowed.