By Implementation

Service Control PoliciesConfig RulesAuto Remediation RulesConformance PacksAmazon GuardDutyAmazon InspectorAWS Security HubAWS Network FirewallRoute53 Resolver SecurityAmazon MacieS3 Bucket PoliciesCloudWatch Alarms and Event RulesAWS WAFAWS Secrets ManagerAWS Systems ManagerSecurity Groups & NACLsAWS KMSIAM Policies

By Service Protected

Configuration Packages

Strategy Guides

Other

S3 Bucket Policies

Restrict Access to Specific IAM Role

An S3 Bucket policy that grants permissions to a specific IAM role to perform any Amazon S3 operations on objects in the specified bucket, and denies all other IAM principals.

This policy requires the Unique IAM Role Identifier which can be found using the steps in this blog post.

AWS Blog Post: How to Restrict Amazon S3 Bucket Access to a Specific IAM Role
Missing Parameters
{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": "s3:*",
            "Resource": [
                "arn:aws:s3:::/*",
                "arn:aws:s3:::"
            ],
            "Condition": {
                "StringLike": {
                    "aws:userId": [
                        ":*",
                        ""
                    ]
                }
            }
        },
        {
            "Effect": "Deny",
            "Action": "s3:*",
            "Resource": [
                "arn:aws:s3:::/*",
                "arn:aws:s3:::"
            ],
            "Condition": {
                "StringNotLike": {
                    "aws:userId": [
                        ":*",
                        ""
                    ]
                }
            }
        }
    ]
}

Actions



Customize Template

Policy Parameters

* Required field