Create IAM User that can view a single S3 bucket

Question

Good morning
I don't know if someone can help me with what I need...
In my AWS console I manage several S3 clients in the same area. A client is asking me for access to his Bucket but after creating the user and assigning a policy, it shows me all the buckets I have in the console.

I have already managed to block access to the buckets that he doesn't have permission to, but it keeps showing me the S3 (which I have with the names of my other clients).

Is there any way to hide the S3 that the user doesn't have access to?

Jahangeer Alam · Answer

It is not possible to provide access to the S3 Console without granting the **ListAllMyBuckets** permission.

An acceptable alternative is to redirect users on sign in directly to the bucket you would like them to see.

To accomplish this, append the following to your IAM sign in url: /s3/?bucket=bucket-name

Full Sign-in URL (replace your-alias and bucket-name): https://your-alias.signin.aws.amazon.com/console/s3/?bucket=bucket-name

IAM Policy (replace bucket-name):

```
{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": "s3:ListAllMyBuckets",
            "Resource": "arn:aws:s3:::*"
        },
        {
            "Effect": "Allow",
            "Action": "s3:*",
            "Resource": [
                "arn:aws:s3:::bucket-name",
                "arn:aws:s3:::bucket-name/*"
            ]
        }
    ]
}
```

Steve_M · Answer

It sounds like you've done as much as you can here. The user needs to have s3:ListAllMyBuckets and s3:GetBucketLocation for the Console to show them the buckets in the account, which they have, but beyond that the output cannot be filtered so that some bucket name(s) are suppressed.

You can allow or deny access to specific buckets, which again it sounds like you have already done.

Create IAM User that can view a single S3 bucket

Relevant content