This KB demonstrates an example of a JSON policy that can be used to limit an Amazon user to manage a specific S3 container. Amazon allows managing access by creating policies and attaching them to IAM users, groups, or roles.
In this example, an IAM resource-based policy is used in order to limit access to a specific container by explicitly deny all operations that require other Amazon services or containers.
In order to create a new AWS IAM Policy, please follow these steps:
Once this policy has been created, it is required to attach this new policy to an existing user or create a new user for this policy.
The JSON policy is included below:
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": "s3:ListAllMyBuckets",
"Resource": "*"
},
{
"Effect": "Allow",
"Action": "s3:*",
"Resource": [
"arn:aws:s3:::BUCKETNAME",
"arn:aws:s3:::BUCKETNAME/*"
]
},
{
"Effect": "Deny",
"NotAction": "s3:*",
"NotResource": [
"arn:aws:s3:::BUCKETNAME",
"arn:aws:s3:::BUCKETNAME/*"
]
}
]
}
© ALL RIGHTS RESERVED. Feedback Terms of Use Privacy Cookie Preference Center