IAM AWS S3 to restrict to a specific sub-folder - amazon-web-services

Question

I'm using AWS S3 component to store files.
I have a bucket called "mybucket" and with the following folders :
+---Mybucket
\---toto1
\---toto2
+---toto3
| \--- subfolder
| \---subsubfolder
\---toto4
I have AWS console users that need only need to access "toto3" folder.
I tried to restrict the access to this folder, but the user must have the right to list the root of bucket. If I put additional rights to acces the root folder, users can browser "toto1" and "toto2" folders and I don't want.
I want to configure something like that:
Authorize to list all buckets of my S3 account (listAllBuckets policy)
Autorize to list the root of the bucket (it's OK for me if the user see the directories names)
Deny access for all prefix bucket different from "toto3"
Autorize every actions for the user in toto3 folder
I don't want to write an inclusive rules
I tried this IAM policy without any success :
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": [
"s3:ListBucket",
"s3:PutObject",
"s3:GetObject"
],
"Resource": ["arn:aws:s3:::mybucket/toto3/*"]
},
{
"Sid": "Stmt1457617383000",
"Effect": "Allow",
"Action": [
"s3:GetBucketLocation",
"s3:ListBucket"
],
"Resource": ["arn:aws:s3:::mybucket"]
},
{
"Sid": "Stmt1457617230000",
"Effect": "Deny",
"Action": ["s3:*"],
"Condition": {
"StringNotLike": {
"s3:prefix": "toto3*"
}
},
"Resource": [
"arn:aws:s3:::mybucket/*"
]
},
{
"Effect": "Allow",
"Action": [
"s3:ListAllMyBuckets"
],
"Resource": [
"*"
]
}
]
}

Answer 1

Here's a policy that will work for you:
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": [
"s3:ListAllMyBuckets"
],
"Resource": [
"*"
]
},
{
"Effect": "Allow",
"Action": [
"s3:PutObject",
"s3:GetObject"
],
"Resource": [
"arn:aws:s3:::mybucket/toto3/*"
]
},
{
"Sid": "Stmt1457617230000",
"Effect": "Allow",
"Action": [
"s3:ListBucket"
],
"Condition": {
"StringLike": {
"s3:prefix": [
"",
"toto3/"
]
}
},
"Resource": [
"arn:aws:s3:::mybucket*"
]
}
]
}
Details:
ListAllMyBuckets is required by the Console. It shows a list of all buckets.
Any action permitted within the toto3/ path.
ListBucket (retrieve objects list) permitted in the root of the bucket and in the toto3/ path.
I successfully tested this solution.
AWS Documentation Reference: Allow Users to Access a Personal "Home Directory" in Amazon S3

Answer 2

I edit your code to have the following and it works ! THanks !!
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": "s3:*",
"Resource": [
"arn:aws:s3:::mybucket/toto3/*"
]
},
{
"Effect": "Allow",
"Action": [
"s3:ListAllMyBuckets",
"s3:GetBucketLocation"
],
"Resource": "arn:aws:s3:::*"
},
{
"Effect": "Allow",
"Action": "s3:ListBucket",
"Resource": "arn:aws:s3:::mybucket",
"Condition": {
"StringLike": {
"s3:prefix": [
"",
"toto3/",
"toto3*"
]
}
}
}
]
}

Answer 3

I need to grant an external vendor access only to a subfolder under a folder, that was under a bucket (!!!). Something like this:
bucket/folder/subfolder
Here's how I accomplished it:
{
"Version": "2012-10-17",
"Statement": [
{
"Sid": "VisualEditor0",
"Effect": "Allow",
"Action": [
"s3:PutObject",
"s3:GetObject",
"s3:ListBucket",
"s3:DeleteObject",
"s3:GetBucketLocation"
],
"Resource": [
"arn:aws:s3:::bucket/*",
"arn:aws:s3:::bucket"
]
"Condition": {
"StringLike": {
"s3:prefix": [
"bucket/folder/subfolder/*",
"bucket/folder/subfolder/",
"bucket/folder/subfolder",
"folder/subfolder/*",
"folder/subfolder/",
"folder/subfolder",
]
}
}
}
]
}

Answer 4

Is it possible to limit the below rule but give specific folder access? I don't want the user see the directory names/folder names with-in the specific bucket.
Autorize to list the root of the bucket (it's OK for me if the user see the directories names)