grant access to one role in another account to all objects in an S3 bucket?

0

Is it possible to grant (read) access to one role in another account to all objects within one bucket while still having "Block all public access" on?

I "fear" that specifying "All" objects in my policy might make my policy "public" in which case it is ignored as long as "Block all public access" is on.

Is it correct?

If so, how should I setup my S3 bucket security to only grant access to that outside role?

EricGfK
질문됨 3년 전1543회 조회
3개 답변
1

Hi there,

The short answer to this question is yes, it is possible to grant a cross account role access to your bucket while having S3 Block Public Access setting activated. Digressing a bit, S3 Block Public Access settings[1] are used to provide control across an entire AWS Account or at the individual S3 bucket level to ensure that objects never have public access. Public access is granted to buckets and objects through access control lists (ACLs), bucket policies, or both.

Now a bucket policy is considered to be granting public access if it contains the Principal value as follows without any restricting conditions:

"Principal": "*"

'*' here is used as a wildcard, to be interpreted as providing anonymous access or access to all.

If such a bucket policy is enabled on a bucket and if the S3 Block Public Access settings are 'on', then S3 Block Public Access settings override the S3 permissions that allow public access. (Specifying all object resources in the bucket policy by itself does not render a bucket public.) Therefore, you can provide access to a cross account role using a bucket policy similar to:

{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Principal": "cross_account_role_ARN",
"Action": "s3:GetObject",
"Resource": "arn:aws:s3:::your_bucket_name/*"
}
]
}

This policy provides read access to all objects in your S3 bucket only to the cross account role. In case you're looking to provide console access, you can also add "s3:ListBucket" permission[2] (with the bucket as the resource) to list all objects in the bucket.

Hope this helps!

References:
[1] S3 Block Public Access - https://aws.amazon.com/s3/features/block-public-access/
[2] Actions defined by Amazon S3 - https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazons3.html#amazons3-actions-as-permissions
[-] Bucket policy examples - https://docs.aws.amazon.com/AmazonS3/latest/userguide/example-bucket-policies.html

AWS
지원 엔지니어
답변함 3년 전
1

I tried to be VERY agressive with my permissions but still unable to read anything in the bucket...

{
"Version": "2012-10-17",
"Id": "Policy1631205389485",
"Statement": [
{
"Sid": "Stmt1631205373926",
"Effect": "Allow",
"Principal": "",
"Action": "s3:
",
"Resource": "arn:aws:s3:::my-bucket-here/*"
}
]
}

I did not even setup the Block All Policy Access

And yet, if I try to browse

aws s3 --profile saml ls s3://my-bucket-here

I get this error message...

An error occurred (AccessDenied) when calling the ListObjectsV2 operation: Access Denied

It looks like I have opened all doors!!!

Edited by: EricGfK on Sep 9, 2021 5:52 PM

EricGfK
답변함 3년 전
1

Apparently, I had to mention both bucket and bucket content in the policy...

        "Resource": \[  
            "arn:aws:s3:::my-bucket-name",  
            "arn:aws:s3:::my-bucket-name/*"  
        ]
EricGfK
답변함 3년 전

로그인하지 않았습니다. 로그인해야 답변을 게시할 수 있습니다.

좋은 답변은 질문에 명확하게 답하고 건설적인 피드백을 제공하며 질문자의 전문적인 성장을 장려합니다.

질문 답변하기에 대한 가이드라인

관련 콘텐츠