AWS IAM S3 Policy

Question

I currently have AWS Policy that grants a user account access to create new users with limited access to IAM and S3

How can I reduce the permission of this user further so the user is unable to list all the S3 buckets on my account

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "VisualEditor0",
            "Effect": "Allow",
            "Action": [
                "iam:PutUserPolicy",
                "iam:GetUser",
                "iam:CreateUser",
                "iam:CreateAccessKey"
            ],
            "Resource": "*"
        },
        {
            "Effect": "Allow",
            "Action": "s3:*",
            "Resource": "*"
        },
        {
            "Effect": "Allow",
            "Action": [
                "cloudformation:*"
            ],
            "Resource": "*"
        }
    ]
}

Well, clearly this policy allows all S3 actions on all resources. What problem are you having reducing this level of access? — jarmod
I need to grant this user the ability to only create new bucket but restrict the ability to list all the buckets on my account — zaddyn00b
You can modify the policy to only allow s3:CreateBucket but that doesn't seem all that useful. How will they access the bucket after they create it, for example? Have you thought through what these users will actually need? — jarmod
This seems like a duplicate of a common question/desire. How do I let people list buckets but only see the ones they are allowed to see? The answer is that you can't. See this answer to a similar question on the workarounds. — Jason Wadsworth

John Rotenstein John Rotenstein · Accepted Answer · 2020-02-09T05:21:12

It is not possible to limit the list of buckets presented to a user. Either they have permission to list all the buckets in an account, or they do not have permission to list any buckets.

The ability to list buckets is separate to the ability to list the contents of a bucket.

AWS IAM S3 Policy

1 Answers