3

My goal is to deny write access to most of a bucket to all users except one, who has full access the the bucket defined in a separate policy attached to the user. The top-level directories of the bucket all contain similar subdirectories. I need to deny access to all subdirectory types except those named subf. Most of the top-level directories contain subdirectories named subf.

This is the policy I currently have:

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Deny",
            "NotPrincipal": {
                "AWS": [
                    "arn:aws:iam::111122223333:root",
                    "arn:aws:iam::111122223333:user/system"
                ]
            },
            "Action": [
                "s3:AbortMultipartUpload",
                "s3:DeleteBucket",
                "s3:DeleteBucketWebsite",
                "s3:DeleteObject",
                "s3:DeleteObjectVersion",
                "s3:PutAccelerateConfiguration",
                "s3:PutBucketAcl",
                "s3:PutBucketCORS",
                "s3:PutBucketLogging",
                "s3:PutBucketNotification",
                "s3:PutBucketRequestPayment",
                "s3:PutBucketTagging",
                "s3:PutBucketVersioning",
                "s3:PutBucketWebsite",
                "s3:PutLifecycleConfiguration",
                "s3:PutReplicationConfiguration",
                "s3:PutObject",
                "s3:PutObjectAcl",
                "s3:PutObjectVersionTagging",
                "s3:Replicate*",
                "s3:RestoreObject"
            ],
            "Resource": [
                "arn:aws:s3:::bucket-test-a/*",
                "arn:aws:s3:::bucket-test-a"
            ],
            "Condition": {
                "StringNotLike": {
                    "s3:prefix": ["*/subf/*"] 
                },
                "StringEquals": {
                    "s3:delimiter": ["/"]
                }
            }
        }
    ]
}

When trying to put this policy on a bucket, I receive the error:

"An error occurred (MalformedPolicy) when calling the PutBucketPolicy operation: Conditions do not apply to combination of actions and resources in statement"

The best clue that I have found is that the 'string condition is meant to apply as a requirement for new objects' https://serverfault.com/questions/569046/anonymous-access-to-s3-bucket-only-from-my-ec2-instances I have been having difficulty finding the documentation to dig deeper into this.

1 Answer 1

15

I believe the problem is that the condition keys you're using aren't applicable to the actions you've specified. For example, if you look at the documentation on S3-specific condition keys, you'll see that for each type of permission (action), there is only a small subset of "Applicable Condition Keys".

The s3:prefix and s3:delimiter condition keys are only applicable to the s3:ListBucket and s3:ListBucketVersions permissions, but neither of those are present in your list of actions.

If you're trying to match s3 bucket keys, you'll probably have to do the matching in the Resource section. For example, you can match subf paths by using "arn:aws:s3:::bucket-test-a/*/subf/*". If you want to match everything but subf paths, then you should use NotResource instead of Resource.

I also notice that you're grouping bucket-level actions with object-level actions. Although that generally works well for simple policies, you'll likely have to split out your policy into multiple statements so your resources match your actions.

1
  • Brilliant! This is exactly right. Sadly these commands sometimes return truly inscrutable error messages.
    – fool4jesus
    Oct 28, 2021 at 21:08

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.