grant access to one role in another account to all objects in an S3 bucket?

0

Is it possible to grant (read) access to one role in another account to all objects within one bucket while still having "Block all public access" on?

I "fear" that specifying "All" objects in my policy might make my policy "public" in which case it is ignored as long as "Block all public access" is on.

Is it correct?

If so, how should I setup my S3 bucket security to only grant access to that outside role?

EricGfK
gefragt vor 3 Jahren1551 Aufrufe
3 Antworten
1

Hi there,

The short answer to this question is yes, it is possible to grant a cross account role access to your bucket while having S3 Block Public Access setting activated. Digressing a bit, S3 Block Public Access settings[1] are used to provide control across an entire AWS Account or at the individual S3 bucket level to ensure that objects never have public access. Public access is granted to buckets and objects through access control lists (ACLs), bucket policies, or both.

Now a bucket policy is considered to be granting public access if it contains the Principal value as follows without any restricting conditions:

"Principal": "*"

'*' here is used as a wildcard, to be interpreted as providing anonymous access or access to all.

If such a bucket policy is enabled on a bucket and if the S3 Block Public Access settings are 'on', then S3 Block Public Access settings override the S3 permissions that allow public access. (Specifying all object resources in the bucket policy by itself does not render a bucket public.) Therefore, you can provide access to a cross account role using a bucket policy similar to:

{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Principal": "cross_account_role_ARN",
"Action": "s3:GetObject",
"Resource": "arn:aws:s3:::your_bucket_name/*"
}
]
}

This policy provides read access to all objects in your S3 bucket only to the cross account role. In case you're looking to provide console access, you can also add "s3:ListBucket" permission[2] (with the bucket as the resource) to list all objects in the bucket.

Hope this helps!

References:
[1] S3 Block Public Access - https://aws.amazon.com/s3/features/block-public-access/
[2] Actions defined by Amazon S3 - https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazons3.html#amazons3-actions-as-permissions
[-] Bucket policy examples - https://docs.aws.amazon.com/AmazonS3/latest/userguide/example-bucket-policies.html

AWS
SUPPORT-TECHNIKER
beantwortet vor 3 Jahren
1

I tried to be VERY agressive with my permissions but still unable to read anything in the bucket...

{
"Version": "2012-10-17",
"Id": "Policy1631205389485",
"Statement": [
{
"Sid": "Stmt1631205373926",
"Effect": "Allow",
"Principal": "",
"Action": "s3:
",
"Resource": "arn:aws:s3:::my-bucket-here/*"
}
]
}

I did not even setup the Block All Policy Access

And yet, if I try to browse

aws s3 --profile saml ls s3://my-bucket-here

I get this error message...

An error occurred (AccessDenied) when calling the ListObjectsV2 operation: Access Denied

It looks like I have opened all doors!!!

Edited by: EricGfK on Sep 9, 2021 5:52 PM

EricGfK
beantwortet vor 3 Jahren
1

Apparently, I had to mention both bucket and bucket content in the policy...

        "Resource": \[  
            "arn:aws:s3:::my-bucket-name",  
            "arn:aws:s3:::my-bucket-name/*"  
        ]
EricGfK
beantwortet vor 3 Jahren

Du bist nicht angemeldet. Anmelden um eine Antwort zu veröffentlichen.

Eine gute Antwort beantwortet die Frage klar, gibt konstruktives Feedback und fördert die berufliche Weiterentwicklung des Fragenstellers.

Richtlinien für die Beantwortung von Fragen