Access denied on AWS s3 bucket even with bucket and/or user policy

Scott Decker

I've tried pretty much every possible bucket policy. Also tried adding a policy to the user, but I get Access Denied every time I try to download an object from s3 bucket using the AWS Console.

Bucket Policy:

{
    "Version": "2012-10-17",
    "Id": "MyPolicy",
    "Statement": [
        {
            "Effect": "Allow",
            "Principal": {
                "AWS": "arn:aws:iam::12345678901011:user/my-username"
            },
            "Action": "s3:*",
            "Resource": [
                "arn:aws:s3:::my-bucket",
                "arn:aws:s3:::my-bucket/*"
            ]
        },
        {
            "Effect": "Allow",
            "Principal": "*",
            "Action": "s3:PutObject",
            "Resource": "arn:aws:s3:::my-bucket/*",
            "Condition": {
                "IpAddress": {
                    "aws:SourceIp": [
                        "XX.XXX.XXX.XXX/24",
                        "XXX.XXX.XXX.XXX/24"
                    ]
                }
            }
        }
    ]
}

That doesn't work so I tried adding a policy to my-username:

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "StmtXXXXXXXXXX",
            "Effect": "Allow",
            "Action": [
                "s3:GetObject",
                "s3:PutObject"
            ],
            "Resource": [
                "arn:aws:s3:::my-bucket",
                "arn:aws:s3:::my-bucket/*"
            ]
        }
    ]
}
John Rotenstein

As strange as it sounds, it is possible to upload an object to Amazon S3 that the account owning the bucket cannot access.

When an object is uploaded to Amazon S3 (PutObject), it is possible to specify an Access Control List (ACL). Possible values are:

  • private
  • public-read
  • public-read-write
  • authenticated-read
  • aws-exec-read
  • bucket-owner-read
  • bucket-owner-full-control

You should normally upload objects with the bucket-owner-full-control ACL. This allows the owner of the bucket access to the object and permission to control the object (eg delete it).

If this permission is not supplied, then they cannot access nor modify the object.

I know that it contradicts the way you'd think buckets should work, but it's true!

How to fix it:

  • Re-upload the objects with bucket-owner-full-control ACL, or
  • The original uploader can loop through the objects and do an in-place CopyObject with a new ACL. This changes the permissions without having to re-upload.

Collected from the Internet

Please contact [email protected] to delete if infringement.

edited at
0

Comments

0 comments
Login to comment

Related

Access denied when put bucket policy on aws s3 bucket with root user (= bucket owner)

Access is denied even if IAM user is specified in S3 bucket policy

AWS S3 Bucket policy editor access denied

AWS - S3 - Creating a Bucket Policy - Error: Access Denied

why user can't access our S3 bucket even after I granted in the bucket policy?

S3 Bucket Policy to allow S3 Access to Current Authenicated user in AWS Console?

S3 Bucket access denied, even for Administrator

How to grant access only to the Root Account User for an S3 bucket with IAM Policy AWS?

AWS S3: user policy for specifc bucket

AWS S3 Bucket policy Access Denyed

AWS CloudFront access denied to S3 bucket

AWS S3 Bucket - Access Denied on Sub-Pages

Rails AssetSync and AWS s3 Bucket Access Denied

Access Denied when creating S3 Bucket ACL & S3 Policy using Terraform

AWS Bucket Policy - limit access to a bucket with bucket policy

AWS access to S3 bucket's folder for user groups

AWS S3 bucket policy with condition

AWS S3 Bucket Policy is not valid

AWS S3 Bucket Policy Whitelist

AWS S3 empty bucket policy

Not Able to Access AWS S3 bucket using AssumeRole by User

s3 Bucket Policies Access Denied

S3 bucket access restriction with bucket policy

AWS: Could not able to give s3 access via s3 bucket policy

Amazon s3 bucket policy access denied when hosting static webpage

access denied when I attempt to upload to s3 with a signed post could it be the bucket policy?

AWS IAM Policy: Restrict Bucket/Folder Access By User/Role?

AWS bucket policy- permission denied

AWS S3 : access denied to object while "bucket block public access" is off