S3 Bucket Policies - Restrict Access to Specific IAM Users

Upcoming Features

An S3 Bucket policy that grants permissions to specific IAM users to perform any Amazon S3 operations on objects in the specified bucket, and denies all other IAM principals.

To restrict access to IAM roles, use this S3 bucket policy.

Policy|CloudFormation |AWS CLI |

Terraform

Missing Parameters

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Principal": {
                "AWS": [
                    ""
                ]
            },
            "Action": "s3:*",
            "Resource": [
                "arn:aws:s3:::/*",
                "arn:aws:s3:::"
            ],
            "Effect": "Allow"
        },
        {
            "NotPrincipal": {
                "AWS": [
                    ""
                ]
            },
            "Action": "s3:*",
            "Resource": [
                "arn:aws:s3:::/*",
                "arn:aws:s3:::"
            ],
            "Effect": "Deny"
        }
    ]
}

* Required field

Configuration Source: AWS Documentation

Additional Documentation:

AWS Documentation: Add/Edit S3 Bucket Policies (Manual Steps)
AWS Documentation: S3 Bucket Policy Language Overview
CloudFormation Reference Guide: S3 Bucket Policies
AWS CLI Command Reference Guide: S3 Bucket Policies

Configuration to create an S3 bucket with security configuration options including s3 block public access configuration, encryption, logging, and versioning

Configuration Item

Security Control

Configuration Packages

Service

Security Strategy Guides

Solutions, Guides & Tools

Overview

Configuration Templates

Actions

Customize Template

Policy Parameters

Sources and Documentation