Overview
An S3 Bucket policy that grants permissions to a specific IAM role to perform any Amazon S3 operations on objects in the specified bucket, and denies all other IAM principals.
This policy requires the Unique IAM Role Identifier which can be found using the steps in this blog post.
Configuration Templates
TerraformMissing Parameters
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": "s3:*",
"Resource": [
"arn:aws:s3:::/*",
"arn:aws:s3:::"
],
"Condition": {
"StringLike": {
"aws:userId": [
":*",
""
]
}
}
},
{
"Effect": "Deny",
"Action": "s3:*",
"Resource": [
"arn:aws:s3:::/*",
"arn:aws:s3:::"
],
"Condition": {
"StringNotLike": {
"aws:userId": [
":*",
""
]
}
}
}
]
}Actions
Customize Template
Policy Parameters
Sources and Documentation
Configuration Source: AWS Blog Post: How to Restrict Amazon S3 Bucket Access to a Specific IAM Role
Additional Documentation:
- AWS Documentation: Add/Edit S3 Bucket Policies (Manual Steps)
- AWS Documentation: S3 Bucket Policy Language Overview
- CloudFormation Reference Guide: S3 Bucket Policies
- AWS CLI Command Reference Guide: S3 Bucket Policies