Configuring IAM Authentication for Amazon S3 and Amazon S3 V2 Connectors

Back Next

Grant folder-level and object-level access

If you do not want to provide bucket-level access to the users, you can restrict the access by granting folder-level and object-level access. You can enable users to access only particular files or folders within a bucket by granting folder-level and object-level permissions.

For example, the following code snippet shows that the user can read a file

customers.csv

from

SubFolder1

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "ListBucketAccess",
            "Effect": "Allow",
            "Action": [
                "s3:ListBucket"
            ],
            "Resource": [
                "arn:aws:s3:::<bucket_name>"
            ]
        },
        {
            "Sid": "GetObjectAccessForFileInSubFolder",
            "Effect": "Allow",
            "Action": [
                "s3:GetObject"
            ],
            "Resource": [
                "arn:aws:s3:::<bucket_name>/<Folder1>/<SubFolder1>/customers.csv"
            ]
        }
    ]
}

Additionally, users can read all files within a particular sub-folder. The following snippet shows a sample Amazon S3 bucket policy that allows users to read all files within

SubFolder1

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "ListBucketAccess",
            "Effect": "Allow",
            "Action": [
                "s3:ListBucket"
            ],
            "Resource": [
                "arn:aws:s3:::<bucket_name>"
            ]
        },
        {
            "Sid": "GetObjectAccessForSubFolder",
            "Effect": "Allow",
            "Action": [
                "s3:GetObject"
            ],
            "Resource": [
                "arn:aws:s3:::<bucket_name>/Folder1/SubFolder1/*"
            ]
        }
    ]
}

You can enable read and write access to users where they can list, read from, write to, and delete data within particular files or folders.

The following snippet shows a sample Amazon S3 bucket policy that demonstrates how users can list, read, write data in multiple parts, and delete files from

SubFolder1

within the

bucket_name

 {
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "ListBucketAccess",
            "Effect": "Allow",
            "Action": [
                "s3:ListBucket"
            ],
            "Resource": [
                "arn:aws:s3:::<bucket_name>"
            ]
        },
        {
            "Sid": "S3WriteAccessToSpecificFolder",
            "Effect": "Allow",
            "Action": [
                "s3:PutObject",
                "s3:GetObject",
                "s3:DeleteObject",
                "s3:ListBucketMultipartUploads"
            ],
            "Resource": [
                "arn:aws:s3:::<bucket_name>/<Folder1>/<SubFolder1>/*"
            ]
        }
    ]
}

When you enable access to a particular folder, the entire bucket is listed. In order to provide access to a particular object within a folder, you can define a condition to restrict the access to object-level to a particular folder. This will prevent listing of all the folders within the Amazon S3 bucket and provide a very secured access to a particular folder.

The following snippet shows a sample Amazon S3 bucket policy that demonstrates how users can access a particular object within a subfolder:

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "AllowListingOfUserFolder",
            "Action": [
                "s3:ListBucket"
            ],
            "Effect": "Allow",
            "Resource": [
                "arn:aws:s3:::infa.qa.minimum.access.bucket"
            ],
            "Condition": {
                "StringLike": {
                    "s3:prefix": [
                        "SubFolder_1/*"
                    ]
                }
            }
        },
        {
            "Sid": "S3OperationsFolderLevel",
            "Effect": "Allow",
            "Action": [
                "s3:PutObject",
                "s3:GetObject",
                "s3:DeleteObject"
            ],
            "Resource": "arn:aws:s3:::infa.qa.minimum.access.bucket/SubFolder_1/*"
        }
    ]
}

The

StringLike

condition enables access to a particular sub-folder without listing the contents of all the folders within the S3 bucket. You can perform the operations at a folder-level instead of bucket-level.

For mappings in advanced mode, the StringLike condition is restricted to bucket-level access only. You can still access the objects within the folder, but the entire contents are listed. This is done by providing the

AllowListBucketMultipartUploads

permission at bucket level.

The following snippet shows a sample Amazon S3 bucket policy that demonstrates how users can access a particular object within a subfolder for mappings in advanced mode:

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "AllowListingOfUserFolder",
            "Action": [
                "s3:ListBucket"
            ],
            "Effect": "Allow",
            "Resource": [
                "arn:aws:s3:::infa.qa.minimum.access.bucket"
            ],
            "Condition": {
                "StringLike": {
                    "s3:prefix": [
                        "SubFolder_1/*"
                    ]
                }
            }
        },
        {
            "Sid": "AllowListBucketMultipartUploads",
            "Action": [
                "s3:ListBucketMultipartUploads"
            ],
            "Effect": "Allow",
            "Resource": [
                "arn:aws:s3:::infa.qa.minimum.access.bucket"
            ]
        },
        {
            "Sid": "S3OperationsFolderLevel",
            "Effect": "Allow",
            "Action": [
                "s3:PutObject",
                "s3:GetObject",
                "s3:DeleteObject",
                "s3:PutObjectTagging"
            ],
            "Resource": "arn:aws:s3:::infa.qa.minimum.access.bucket/SubFolder_1/*"
        }
    ]
}

Rename Saved Search

Table of Contents

Configuring IAM Authentication for Amazon S3 and Amazon S3 V2 Connectors

Configuring IAM Authentication for Amazon S3 and Amazon S3 V2 Connectors

Grant folder-level and object-level access

Grant folder-level and object-level access